SB2021100522 - Multiple vulnerabilities in Qualcomm chipsets
Published: October 5, 2021 Updated: February 6, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 31 secuirty vulnerabilities.
1) Improper Access Control (CVE-ID: CVE-2021-1932)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in QTEE. A local application can execute arbitrary code.
2) Use of Out-of-range Pointer Offset (CVE-ID: CVE-2021-30316)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Multimedia Drivers. A local application can execute arbitrary code.
3) Buffer over-read (CVE-ID: CVE-2021-30306)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in DSP Services. A local application can execute arbitrary code.
4) Improper Input Validation (CVE-ID: CVE-2021-30305)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Linux Graphics. A local application can execute arbitrary code.
5) Buffer overflow (CVE-ID: CVE-2021-30297)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in VR Service. A local application can execute arbitrary code.
6) Incorrect Calculation of Buffer Size (CVE-ID: CVE-2021-30292)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in VR Service. A local application can execute arbitrary code.
7) Incorrect Calculation of Buffer Size (CVE-ID: CVE-2021-30291)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in VR Service. A local application can execute arbitrary code.
8) Stack-based buffer overflow (CVE-ID: CVE-2021-30258)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in VR Service. A local application can execute arbitrary code.
9) Improper Validation of Array Index (CVE-ID: CVE-2021-30257)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in VR Service. A local application can execute arbitrary code.
10) Buffer overflow (CVE-ID: CVE-2021-30256)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in VR Service. A local application can execute arbitrary code.
11) Buffer over-read (CVE-ID: CVE-2021-1985)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in VR Service. A local application can execute arbitrary code.
12) Integer overflow (CVE-ID: CVE-2021-1984)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in VR Service. A local application can execute arbitrary code.
13) Integer overflow (CVE-ID: CVE-2021-1983)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in VR Service. A local application can execute arbitrary code.
14) Integer overflow (CVE-ID: CVE-2021-1949)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Display. A local application can execute arbitrary code.
15) NULL Pointer Dereference (CVE-ID: CVE-2021-1936)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation in Modem. A remote attacker can perform a denial of service (DoS) attack.
16) NULL Pointer Dereference (CVE-ID: CVE-2021-1917)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in DIAG. A local application can execute arbitrary code.
17) Untrusted Pointer Dereference (CVE-ID: CVE-2021-1959)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Data Modem. A local application can execute arbitrary code.
18) Integer overflow (CVE-ID: CVE-2021-1913)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Trust Zone. A local application can execute arbitrary code.
19) Improper Access Control (CVE-ID: CVE-2020-11303)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to improper input validation in WLAN. A remote attacker can gain access to sensitive information.
20) Information Exposure (CVE-ID: CVE-2021-1969)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improper input validation in Neural Processing. A local application can gain access to sensitive information.
21) Information Exposure (CVE-ID: CVE-2021-1968)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improper input validation in Neural Processing. A local application can gain access to sensitive information.
22) Stack-based buffer overflow (CVE-ID: CVE-2021-1967)
The vulnerability allows a local application to read and manipulate data.
The vulnerability exists due to improper input validation in WLAN. A local application can read and manipulate data.
23) Buffer overflow (CVE-ID: CVE-2021-1966)
The vulnerability allows a local privileged application to execute arbitrary code.
The vulnerability exists due to improper input validation in Display. A local privileged application can execute arbitrary code.
24) Use After Free (CVE-ID: CVE-2021-30315)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Sensor Hardware Abstraction Layer. A local application can execute arbitrary code.
25) Improper Input Validation (CVE-ID: CVE-2021-30310)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation in WLAN. A remote attacker can perform a denial of service (DoS) attack.
26) Improper Authentication (CVE-ID: CVE-2021-30312)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to improper input validation in WIGIG Host. A remote attacker can gain access to sensitive information.
27) Improper Authentication (CVE-ID: CVE-2021-30302)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to improper input validation in WLAN. A remote attacker can gain access to sensitive information.
28) Buffer over-read (CVE-ID: CVE-2021-1980)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation in WLAN. A remote attacker can perform a denial of service (DoS) attack.
29) Buffer over-read (CVE-ID: CVE-2021-30304)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation in WLAN. A remote attacker can perform a denial of service (DoS) attack.
30) Buffer over-read (CVE-ID: CVE-2021-1977)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation in WLAN. A remote attacker can perform a denial of service (DoS) attack.
31) Stack-based buffer overflow (CVE-ID: CVE-2021-30288)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in WLAN. A local application can execute arbitrary code.
Remediation
Install update from vendor's website.