SB2024040135 - Multiple vulnerabilities in Qualcomm chipsets

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2024040135

SB2024040135 - Multiple vulnerabilities in Qualcomm chipsets

Published: April 1, 2024 Updated: August 26, 2024

Security Bulletin ID SB2024040135
Severity
High
Patch available
YES
Number of vulnerabilities 16
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 6% Medium 44% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 16 secuirty vulnerabilities.


1) Improper input validation (CVE-ID: CVE-2023-33100)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation in Multi-Mode Call Processor. A remote attacker can perform a denial of service (DoS) attack.


2) Integer overflow (CVE-ID: CVE-2024-21470)

The vulnerability allows a local application to execute arbitrary code.

The vulnerability exists due to improper input validation in Graphics Windows. A local application can execute arbitrary code.


3) Integer overflow (CVE-ID: CVE-2024-21454)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation in Automotive Telematics. A remote attacker can perform a denial of service (DoS) attack.


4) Improper input validation (CVE-ID: CVE-2024-21453)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation in Automotive Telematics. A remote attacker can perform a denial of service (DoS) attack.


5) Improper input validation (CVE-ID: CVE-2024-21452)

The vulnerability allows a remote attacker to read and manipulate data.

The vulnerability exists due to improper input validation in Automotive Telematics. A remote attacker can read and manipulate data.


6) Buffer over-read (CVE-ID: CVE-2023-33115)

The vulnerability allows a local application to execute arbitrary code.

The vulnerability exists due to improper input validation in Trusted Execution Environment. A local application can execute arbitrary code.


7) Type conversion (CVE-ID: CVE-2023-33101)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation in Multi-Mode Call Processor. A remote attacker can perform a denial of service (DoS) attack.


8) Improper input validation (CVE-ID: CVE-2023-33099)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation in Multi-Mode Call Processor. A remote attacker can perform a denial of service (DoS) attack.


9) Improper input validation (CVE-ID: CVE-2024-21473)

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper input validation in WIN SON. A remote attacker can execute arbitrary code.


10) Buffer overflow (CVE-ID: CVE-2023-33023)

The vulnerability allows a local application to execute arbitrary code.

The vulnerability exists due to improper input validation in SPS-Applications. A local application can execute arbitrary code.


11) Buffer overflow (CVE-ID: CVE-2023-28547)

The vulnerability allows a local application to execute arbitrary code.

The vulnerability exists due to improper input validation in SPS Applications. A local application can execute arbitrary code.


12) Buffer overflow (CVE-ID: CVE-2023-43515)

The vulnerability allows a local application to read and manipulate data.

The vulnerability exists due to improper input validation in HLOS. A local application can read and manipulate data.


13) Input validation error (CVE-ID: CVE-2023-33111)

The vulnerability allows a local application to bypass implemented security restrictions.

The vulnerability exists due to insufficient validation of user-supplied input within the Audio component. A local application bypass implemented security restrictions.


14) Use After Free (CVE-ID: CVE-2024-21472)

The vulnerability allows a local application to execute arbitrary code.

The vulnerability exists due to improper input validation in Kernel. A local application can execute arbitrary code.


15) Use After Free (CVE-ID: CVE-2024-21468)

The vulnerability allows a local application to execute arbitrary code.

The vulnerability exists due to failed unmap operation in GPU in Kernel. A local application can execute arbitrary code.


16) Buffer overflow (CVE-ID: CVE-2024-21463)

The vulnerability allows a remote attacker to read and manipulate data.

The vulnerability exists due to improper input validation in Audio. A remote attacker can read and manipulate data.


Remediation

Install update from vendor's website.

References