SB2023070318 - Multiple vulnerabilities in Qualcomm chipsets
Published: July 3, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 18 secuirty vulnerabilities.
1) Buffer overflow (CVE-ID: CVE-2023-21640)
The vulnerability allows a local privileged application to execute arbitrary code.
The vulnerability exists due to improper input validation in Linux. A local privileged application can execute arbitrary code.
2) Buffer over-read (CVE-ID: CVE-2023-28542)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in WLAN HOST. A local application can execute arbitrary code.
3) Buffer over-read (CVE-ID: CVE-2023-28541)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in WLAN Host. A local application can execute arbitrary code.
4) Stack-based buffer overflow (CVE-ID: CVE-2023-24854)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in WLAN HOST. A local application can execute arbitrary code.
5) Use After Free (CVE-ID: CVE-2023-21672)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Audio. A local application can execute arbitrary code.
6) Integer overflow (CVE-ID: CVE-2023-22667)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Audio. A local application can execute arbitrary code.
7) Double Free (CVE-ID: CVE-2023-21629)
The vulnerability allows a local attacker to execute arbitrary code.
The vulnerability exists due to improper input validation in Modem. A local attacker can execute arbitrary code.
8) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-21641)
The vulnerability allows a local application to read, manipulate or delete data.
The vulnerability exists due to improper input validation in Display. A local application can read, manipulate or delete data.
9) Buffer overflow (CVE-ID: CVE-2023-21639)
The vulnerability allows a local privileged application to execute arbitrary code.
The vulnerability exists due to improper input validation in Audio. A local privileged application can execute arbitrary code.
10) Improper input validation (CVE-ID: CVE-2023-21631)
The vulnerability allows a remote attacker to manipulate data.
The vulnerability exists due to improper input validation in Modem. A remote attacker can manipulate data.
11) Type conversion (CVE-ID: CVE-2023-21638)
The vulnerability allows a local privileged application to execute arbitrary code.
The vulnerability exists due to improper input validation in Video. A local privileged application can execute arbitrary code.
12) Memory corruption (CVE-ID: CVE-2023-21637)
The vulnerability allows a local privileged application to execute arbitrary code.
The vulnerability exists due to improper input validation in Linux. A local privileged application can execute arbitrary code.
13) Buffer overflow (CVE-ID: CVE-2023-21635)
The vulnerability allows a local privileged application to execute arbitrary code.
The vulnerability exists due to improper input validation in Data Network Stack & Connectivity. A local privileged application can execute arbitrary code.
14) Memory corruption (CVE-ID: CVE-2023-21633)
The vulnerability allows a local privileged application to execute arbitrary code.
The vulnerability exists due to improper input validation in Linux. A local privileged application can execute arbitrary code.
15) Information exposure (CVE-ID: CVE-2023-21624)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to improper input validation in DSP Services. A local application can gain access to sensitive information.
16) Buffer overflow (CVE-ID: CVE-2023-24851)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in WLAN HOST. A local application can execute arbitrary code.
17) Use of Out-of-range Pointer Offset (CVE-ID: CVE-2023-22387)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Qualcomm IPC. A local application can execute arbitrary code.
18) Buffer overflow (CVE-ID: CVE-2023-22386)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in WLAN HOST. A local application can execute arbitrary code.
Remediation
Install update from vendor's website.