Ricoh Company, Ltd. Security Vulnerabilities

CVE-2023-33046

Memory corruption in Trusted Execution Environment while deinitializing an object used for license...

CVE-2023-33044

Transient DOS in Data modem while handling TLB control messages from the...

CVE-2023-33030

Memory corruption in HLOS while running playready...

CVE-2023-33024

Memory corruption while sending SMS from AP...

CVE-2023-33022

Memory corruption in HLOS while invoking IOCTL calls from...

CVE-2023-28583

Memory corruption when IPv6 prefix timer object`s lifetime expires which are created while Netmgr daemon gets an IPv6...

CVE-2023-28583

Memory corruption when IPv6 prefix timer object`s lifetime expires which are created while Netmgr daemon gets an IPv6...

CVE-2023-28551

Memory corruption in UTILS when modem processes memory specific Diag commands having arbitrary address values as input...

CVE-2023-22383

Memory Corruption in camera while installing a fd for a particular DMA...

CVE-2023-21634

Memory Corruption in Radio Interface Layer while sending an SMS or writing an SMS to...

CVE-2023-33079 Use of Out-of-range Pointer Offset in Audio

Memory corruption in Audio while running invalid audio recording from...

CVE-2023-33043 Reachable Assertion in Modem

Transient DOS in Modem when a Beam switch request is made with a non-configured...

CVE-2023-33041 Reachable assertion in WLAN Firmware

Under certain scenarios the WLAN Firmware will reach an assertion due to state confusion while looking up peer...

CVE-2023-43514 Use After Free in DSP Services

Memory corruption while invoking IOCTLs calls from user space for internal mem MAP and internal mem...

CVE-2023-33116 Buffer over-read without Checking Size of Input in WLAN Host

Transient DOS while parsing ieee80211_parse_mscs_ie in WIN WLAN...

CVE-2023-33109 NULL Pointer Dereference in WLAN Firmware

Transient DOS while processing a WMI P2P listen start command (0xD00A) sent from...

CVE-2023-33085 Buffer Copy Without Checking Size of Input (Classic Buffer Overflow) in Wearables

Memory corruption in wearables while processing data from...

CVE-2023-33040 Buffer Over-read in Data Modem

Transient DOS in Data Modem during DTLS...

CVE-2023-33033 Use of Out-of-range Pointer Offset in Audio

Memory corruption in Audio during playback with speaker...

CVE-2023-33030 Buffer Copy without Checking Size of Input in HLOS

Memory corruption in HLOS while running playready...

CVE-2023-43536 Buffer Over-read in WLAN Firmware

Transient DOS while parse fils IE with length equal to...

CVE-2023-43522 NULL Pointer Dereference in WLAN Firmware

Transient DOS while key unwrapping process, when the given encrypted key is empty or...

CVE-2023-33076 Configuration Issue in Core

Memory corruption in Core when updating rollback version for TA and OTA feature is...

CVE-2023-33068 Buffer Copy Without Checking Size of Input in Audio

Memory corruption in Audio while processing IIR config data from AFE calibration...

CVE-2023-33046 Time-of-check Time-of-use (TOCTOU) Race Condition in Trusted Execution Environment

Memory corruption in Trusted Execution Environment while deinitializing an object used for license...

CVE-2023-43552

Memory corruption while processing MBSSID beacon containing several subelement...

CVE-2023-43553

Memory corruption while parsing beacon/probe response frame when AP sends more supported links in...

CVE-2023-43546

Memory corruption while invoking HGSL IOCTL context...

CVE-2023-33105

Transient DOS in WLAN Host and Firmware when large number of open authentication frames are sent with an invalid transaction sequence...

CVE-2023-33066

Memory corruption in Audio while processing RT proxy port register...

CVE-2023-28578

Memory corruption in Core Services while executing the command for removing a single event...

New Rust-based Fickle Malware Uses PowerShell for UAC Bypass and Data Exfiltration

A new Rust-based information stealer malware called Fickle Stealer has been observed being delivered via multiple attack chains with the goal of harvesting sensitive information from compromised hosts. Fortinet FortiGuard Labs said it's aware of four different distribution methods -- namely VBA...

CVE-2023-33086 Improper Release of Memory Before Removing Last Reference in Data Modem

Transient DOS while processing multiple IKEV2 Informational Request to device from IPSEC server with different...

CVE-2023-33084 Improper Release of Memory Before Removing Last Reference in Data Modem

Transient DOS while processing IE fragments from server during DTLS...

CVE-2023-33059

Memory corruption in Audio while processing the VOC packet data from...

CVE-2023-33056

Transient DOS in WLAN Firmware when firmware receives beacon including T2LM...

CVE-2023-33034

Memory corruption while parsing the ADSP response...

CVE-2023-33026

Transient DOS in WLAN Firmware while parsing a NAN management...

CVE-2023-33021

Memory corruption in Graphics while processing user packets for command...

CVE-2023-33015

Transient DOS in WLAN Firmware while interpreting MBSSID IE of a received beacon...

CVE-2023-28577

In the function call related to CAM_REQ_MGR_RELEASE_BUF there is no check if the buffer is being used. So when a function called cam_mem_get_cpu_buf to get the kernel va to use, another thread can call CAM_REQ_MGR_RELEASE_BUF to unmap the kernel va which cause UAF of the kernel...

CVE-2023-28575

The cam_get_device_priv function does not check the type of handle being returned (device/session/link). This would lead to invalid type usage if a wrong handle is passed to...

CVE-2023-28567

Memory corruption in WLAN HAL while handling command through WMI...

CVE-2023-28564

Memory corruption in WLAN HAL while passing command parameters through WMI...

CVE-2023-28562

Memory corruption while handling payloads from remote...

CVE-2023-28559

Memory corruption in WLAN FW while processing command parameters from untrusted WMI...

CVE-2023-28561

Memory corruption in QESL while processing payload from external ESL device to...

CVE-2023-28558

Memory corruption in WLAN handler while processing PhyID in Tx status...

CVE-2023-28558

Memory corruption in WLAN handler while processing PhyID in Tx status...

CVE-2023-28553

Information Disclosure in WLAN Host when processing WMI event...