Ricoh Company, Ltd. Security Vulnerabilities

CVE-2022-33309

Transient DOS due to buffer over-read in WLAN Firmware while parsing secure FTMR frame with size lesser than 39...

CVE-2022-33301

Memory corruption due to incorrect type conversion or cast in audio while using audio playback/capture when crafted address is sent from AGM IPC to...

CVE-2022-33291

Information disclosure in Modem due to buffer over-read while receiving a IP header with malformed...

CVE-2022-33281

Memory corruption due to improper validation of array index in computer vision while testing EVA kernel without sending any...

CVE-2022-33280

Memory corruption due to access of uninitialized pointer in Bluetooth HOST while processing the AVRCP...

CVE-2022-33278

Memory corruption due to buffer copy without checking the size of input in HLOS when input message size is larger than the buffer...

CVE-2022-33273

Information disclosure due to buffer over-read in Trusted Execution Environment while QRKS report...

CVE-2022-33271

Information disclosure due to buffer over-read in WLAN while parsing NMF...

CVE-2022-33263

Memory corruption due to use after free in Core when multiple DCI clients register and...

CVE-2022-33259

Memory corruption due to buffer copy without checking the size of input in modem while decoding raw SMS...

CVE-2022-33254

Transient DOS due to reachable assertion in Modem while processing SIB1...

CVE-2022-33246

Memory corruption in Audio due to use of out-of-range pointer offset while Initiating a voice call session from user space with invalid session...

CVE-2022-33243

Memory corruption due to improper access control in Qualcomm...

CVE-2022-33227

Memory corruption in Linux android due to double free while calling unregister provider after register...

CVE-2022-33226

Memory corruption due to buffer copy without checking the size of input in Core while processing ioctl commands from diag client...

CVE-2022-33225

Memory corruption due to use after free in trusted application...

CVE-2022-33222

Information disclosure due to buffer over-read while parsing DNS response packets in...

CVE-2022-33221

Information disclosure in Trusted Execution Environment due to buffer over-read while processing metadata verification...

CVE-2022-33220

Information disclosure in Automotive multimedia due to buffer...

CVE-2022-25739

Denial of service in modem due to missing null check while processing the ipv6 packet received during ECM...

CVE-2022-25738

Information disclosure in modem due to buffer over-red while performing checksum of packet...

CVE-2022-25730

Information disclosure in modem due to improper check of IP type while processing DNS server...

CVE-2022-25732

Information disclosure in modem due to buffer over read in dns client due to missing length...

CVE-2022-25728

Information disclosure in modem due to buffer over-read while processing response from DNS...

CVE-2022-25678

Memory correction in modem due to buffer overwrite during coap...

CVE-2022-25655

Memory corruption in WLAN HAL while arbitrary value is passed in WMI UTF command...

CVE-2022-22075

Information Disclosure in Graphics during GPU context...

Cisco Talos at RSAC 2024

With RSAC just a week away, Cisco Talos is gearing up for another year of heading to San Francisco to share in some of the latest major cybersecurity announcements, research and news. We've pulled together the highlights, so you don't miss out on all things Talos. **Tuesday, May 7 ** Joe...

CVE-2022-33280 Access of uninitialized pointer in Bluetooth HOST

Memory corruption due to access of uninitialized pointer in Bluetooth HOST while processing the AVRCP...

CVE-2022-25735 Null Pointer Dereference in MODEM

Denial of service in modem due to missing null check while processing TCP or UDP packets from...

CVE-2022-25733 Null Pointer Dereference in MODEM

Denial of service in modem due to null pointer dereference while processing DNS...

CVE-2022-40537 Improper Validation of Array Index in Bluetooth HOST

Memory corruption in Bluetooth HOST while processing the AVRC_PDU_GET_PLAYER_APP_VALUE_TEXT AVRCP...

CVE-2022-40530 Integer overflow to buffer overflow in WLAN

Memory corruption in WLAN due to integer overflow to buffer overflow in WLAN during initialization...

CVE-2022-33257 Time-of-check time-of-use race condition in Core

Memory corruption in Core due to time-of-check time-of-use race condition during dump collection in trust...

CVE-2022-33242 Improper authentication in Qualcomm IPC

Memory corruption due to improper authentication in Qualcomm IPC while loading unsigned lib in audio...

CVE-2022-40532 Integer overflow or wraparound in WLAN

Memory corruption due to integer overflow or wraparound in WLAN while sending WMI cmd from host to...

CVE-2022-33222 Buffer over-read in Modem

Information disclosure due to buffer over-read while parsing DNS response packets in...

CVE-2022-40504 Reachable assertion in Modem

Transient DOS due to reachable assertion in Modem when UE received Downlink Data Indication message from the...

CVE-2023-21656 Improper Input Validation in WLAN HOST

Memory corruption in WLAN HOST while receiving an WMI event from...

CVE-2022-40525 Information Exposure in Linux Networking Firmware

Information disclosure in Linux Networking Firmware due to unauthorized information leak during side channel...

CVE-2022-33303 Uncontrolled resource consumption in Linux kernel

Transient DOS due to uncontrolled resource consumption in Linux kernel when malformed messages are sent from the Gunyah Resource Manager message...

CVE-2023-21641 Permissions, Privileges, and Access Controls in Display

An app with non-privileged access can change global system brightness and cause undesired system...

CVE-2023-21624 Information Exposure in DSP Services

Information disclosure in DSP Services while loading dynamic...

CVE-2023-28575 Multiple Type Confusion Vulnerability

The cam_get_device_priv function does not check the type of handle being returned (device/session/link). This would lead to invalid type usage if a wrong handle is passed to...

CVE-2023-28561 Buffer Copy Without Checking Size of Input in QESL

Memory corruption in QESL while processing payload from external ESL device to...

CVE-2023-28537 Integer Overflow or Wraparound in Audio

Memory corruption while allocating memory in COmxApeDec module in...

CVE-2023-21650 Improper Validation of Array Index in GPS HLOS Driver

Memory Corruption in GPS HLOS Driver when injectFdclData receives data with invalid data...

CVE-2023-28573 Improper Validation of Array Index in WLAN HAL

Memory corruption in WLAN HAL while parsing WMI command...

CVE-2023-28558 Improper Validation of Array Index in WLAN HAL

Memory corruption in WLAN handler while processing PhyID in Tx status...

CVE-2023-28544 Buffer Copy without Checking the Size of Input in WLAN Firmware

Memory corruption in WLAN while sending transmit command from HLOS to UTF...