Ricoh Company, Ltd. Security Vulnerabilities

CVE-2022-33240 Incorrect type conversion or cast in Audio

Memory corruption in Audio due to incorrect type cast during audio...

CVE-2023-28541 Buffer Over-read in WLAN Host

Memory Corruption in Data Modem while processing DMA buffer release event about CFR...

CVE-2023-24854 Stack-based Buffer Overflow in WLAN HOST

Memory Corruption in WLAN HOST while parsing QMI WLAN Firmware response...

CVE-2023-24851 Buffer Copy Without Checking Size of Input in WLAN HOST

Memory Corruption in WLAN HOST while parsing QMI response message from...

CVE-2023-22386 Buffer Copy Without Checking Size of Input in WLAN HOST

Memory Corruption in WLAN HOST while processing WLAN FW request to allocate...

CVE-2023-21638 Incorrect Type Conversion or Cast in Video

Memory corruption in Video while calling APIs with different instance ID than the one received in...

CVE-2023-22666 Integer Overflow or Wraparound in Audio

Memory Corruption in Audio while playing amrwbplus clips with modified...

CVE-2023-33021 Use After Free in Graphics

Memory corruption in Graphics while processing user packets for command...

CVE-2023-33020 Improper Authorization in WLAN Host

Transient DOS in WLAN Host when an invalid channel (like channel out of range) is received in STA during CSA...

CVE-2023-28567 Improper Validation of Array Index in WLAN HAL

Memory corruption in WLAN HAL while handling command through WMI...

CVE-2023-28559 Buffer Copy Without Checking Size of Input in WLAN HAL

Memory corruption in WLAN FW while processing command parameters from untrusted WMI...

CVE-2023-21664 Buffer Copy without Checking the Size of Input(Classic Buffer Overflow) in Core Platform

Memory Corruption in Core Platform while printing the response buffer in...

CVE-2023-21655 Integer Overflow or Wraparound in Display

Memory corruption in Audio while validating and mapping...

CVE-2022-33275 Improper validation of array index in WLAN HAL

Memory corruption due to improper validation of array index in WLAN HAL when received lm_itemNum is out of...

CVE-2023-33039 Use After Free in Automotive Display

Memory corruption in Automotive Display while destroying the image handle created using connected display...

CVE-2023-33035 Buffer Copy Without Checking Size of Input in Audio

Memory corruption while invoking callback function of AFE from...

CVE-2023-24853 Improper Input Validation in HLOS

Memory Corruption in HLOS while registering for key provisioning...

CVE-2023-24849 Buffer Over-read in Data Modem

Information Disclosure in data Modem while parsing an FMTP line in an SDP...

CVE-2023-22384 Buffer Copy Without Checking Size of Input in VR Service

Memory Corruption in VR Service while sending data using Fast Message Queue...

CVE-2023-21673 Improper Access Control in Kernel

Improper Access to the VM resource manager can lead to Memory...

CVE-2023-33061 Buffer Over-read in WLAN Firmware

Transient DOS in WLAN Firmware while parsing WLAN beacon or probe-response...

CVE-2023-28570 Buffer Copy without Checking Size of Input in Audio

Memory corruption while processing audio...

CVE-2023-43534

Memory corruption while validating the TID to Link Mapping action request frame, when a station connects to an access...

CVE-2023-43533

Transient DOS in WLAN Firmware when the length of received beacon is less than length of ieee802.11 beacon...

CVE-2023-43533

Transient DOS in WLAN Firmware when the length of received beacon is less than length of ieee802.11 beacon...

CVE-2023-43523

Transient DOS while processing 11AZ RTT management action frame received through...

CVE-2023-43522

Transient DOS while key unwrapping process, when the given encrypted key is empty or...

CVE-2023-43519

Memory corruption in video while parsing the Videoinfo, when the size of atom is greater than the videoinfo...

CVE-2023-43520

Memory corruption when AP includes TID to link mapping IE in the beacons and STA is parsing the beacon TID to link mapping...

CVE-2023-43518

Memory corruption in video while parsing invalid mp2...

CVE-2023-43514

Memory corruption while invoking IOCTLs calls from user space for internal mem MAP and internal mem...

CVE-2023-43513

Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to address in the middle of ring...

CVE-2023-33120

Memory corruption in Audio when memory map command is executed consecutively in...

CVE-2023-33114

Memory corruption while running NPU, when NETWORK_UNLOAD and (NETWORK_UNLOAD or NETWORK_EXECUTE_V2) commands are submitted at the same...

CVE-2023-33114

Memory corruption while running NPU, when NETWORK_UNLOAD and (NETWORK_UNLOAD or NETWORK_EXECUTE_V2) commands are submitted at the same...

CVE-2023-33110

The session index variable in PCM host voice audio driver initialized before PCM open, accessed during event callback from ADSP and reset during PCM close may lead to race condition between event callback - PCM close and reset session index causing memory...

CVE-2023-33112

Transient DOS when WLAN firmware receives "reassoc response" frame including RIC_DATA...

CVE-2023-33094

Memory corruption while running VK synchronization with KASAN...

CVE-2023-33092

Memory corruption while processing pin reply in Bluetooth, when pin code received from APP layer is greater than expected...

CVE-2023-33092

Memory corruption while processing pin reply in Bluetooth, when pin code received from APP layer is greater than expected...

CVE-2023-33098

Transient DOS while parsing WPA IES, when it is passed with length more than expected...

CVE-2023-33097

Transient DOS in WLAN Firmware while processing a FTMR...

CVE-2023-33082

Memory corruption while sending an Assoc Request having BTM Query or BTM Response containing MBO...

CVE-2023-33087

Memory corruption in Core while processing RX intent...

CVE-2023-33071

Memory corruption in Automotive OS whenever untrusted apps try to access HAb for graphics...

CVE-2023-33067

Memory corruption in Audio while calling START command on host voice PCM multiple times for the same RX or TX tap...

CVE-2023-33065

Information disclosure in Audio while accessing AVCS services from ADSP...

CVE-2023-33065

Information disclosure in Audio while accessing AVCS services from ADSP...

CVE-2023-33054

Cryptographic issue in GPS HLOS Driver while downloading Qualcomm GNSS assistance...

CVE-2023-33054

Cryptographic issue in GPS HLOS Driver while downloading Qualcomm GNSS assistance...