CVSS: 7.8EPSS: 0%CPEs: 562EXPL: 0CVE-2023-28557 – Improper Validation of Array Index in WLAN HAL
https://notcve.org/view.php?id=CVE-2023-28557
05 Sep 2023 — Memory corruption in WLAN HAL while processing command parameters from untrusted WMI payload. Corrupción de memoria en WLAN HAL al procesar parámetros de comando de un payload WMI que no es de confianza. • https://www.qualcomm.com/company/product-security/bulletins/september-2023-bulletin • CWE-129: Improper Validation of Array Index •
CVSS: 7.8EPSS: 0%CPEs: 418EXPL: 0CVE-2023-28544 – Buffer Copy without Checking the Size of Input in WLAN Firmware
https://notcve.org/view.php?id=CVE-2023-28544
05 Sep 2023 — Memory corruption in WLAN while sending transmit command from HLOS to UTF handlers. Corrupción de memoria en WLAN al enviar comandos de transmisión desde HLOS a controladores UTF. • https://www.qualcomm.com/company/product-security/bulletins/september-2023-bulletin • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 8.4EPSS: 0%CPEs: 260EXPL: 0CVE-2023-28538 – Stack-based Buffer Overflow in WIN Product
https://notcve.org/view.php?id=CVE-2023-28538
05 Sep 2023 — Memory corruption in WIN Product while invoking WinAcpi update driver in the UEFI region. Corrupción de la memoria en el producto WIN al invocar el controlador de actualización WinAcpi en la región UEFI. • https://www.qualcomm.com/company/product-security/bulletins/september-2023-bulletin • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 0%CPEs: 86EXPL: 0CVE-2023-21667 – Buffer Over-read in Bluetooth HOST
https://notcve.org/view.php?id=CVE-2023-21667
05 Sep 2023 — Transient DOS in Bluetooth HOST while passing descriptor to validate the blacklisted BT keyboard. Vulnerabilidad de denegación de servicios (DoS) transitorio en Bluetooth HOST al pasar el descriptor para validar el teclado BT de la lista negra. • https://www.qualcomm.com/company/product-security/bulletins/september-2023-bulletin • CWE-125: Out-of-bounds Read CWE-126: Buffer Over-read •
CVSS: 7.8EPSS: 0%CPEs: 112EXPL: 0CVE-2023-21654 – Improper Restriction of Operations within the Bounds of a Memory Buffer in Audio
https://notcve.org/view.php?id=CVE-2023-21654
05 Sep 2023 — Memory corruption in Audio during playback session with audio effects enabled. Corrupción de la memoria en audio durante la sesión de reproducción con efectos de audio habilitados. • https://www.qualcomm.com/company/product-security/bulletins/september-2023-bulletin • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 62EXPL: 0CVE-2023-28577 – Multiple Dmabuf Kernel Address UAF Vulnerability
https://notcve.org/view.php?id=CVE-2023-28577
08 Aug 2023 — In the function call related to CAM_REQ_MGR_RELEASE_BUF there is no check if the buffer is being used. So when a function called cam_mem_get_cpu_buf to get the kernel va to use, another thread can call CAM_REQ_MGR_RELEASE_BUF to unmap the kernel va which cause UAF of the kernel address. En la llamada a la función CAM_REQ_MGR_RELEASE_BUF no se comprueba si el buffer está siendo utilizado. Así que cuando una función llama a cam_mem_get_cpu_buf para obtener la va del kernel a utilizar, otro hilo puede llamar a... • https://www.qualcomm.com/company/product-security/bulletins/august-2023-bulletin • CWE-416: Use After Free •
CVSS: 7.0EPSS: 0%CPEs: 62EXPL: 0CVE-2023-28576 – Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Kernel Driver
https://notcve.org/view.php?id=CVE-2023-28576
08 Aug 2023 — The buffer obtained from kernel APIs such as cam_mem_get_cpu_buf() may be readable/writable in userspace after kernel accesses it. In other words, user mode may race and modify the packet header (e.g. header.count), causing checks (e.g. size checks) in kernel code to be invalid. This may lead to out-of-bounds read/write issues. El buffer obtenido de APIs del kernel como cam_mem_get_cpu_buf() puede ser legible/escribible en espacio de usuario después de que el kernel acceda a él. En otras palabras, el modo d... • https://www.qualcomm.com/company/product-security/bulletins/august-2023-bulletin • CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •
CVSS: 7.8EPSS: 0%CPEs: 120EXPL: 0CVE-2023-28575 – Multiple Type Confusion Vulnerability
https://notcve.org/view.php?id=CVE-2023-28575
08 Aug 2023 — The cam_get_device_priv function does not check the type of handle being returned (device/session/link). This would lead to invalid type usage if a wrong handle is passed to it. La función cam_get_device_priv no comprueba el tipo de manejador devuelto (device/session/link). Esto llevaría a un uso de tipo inválido si se le pasa un manejador incorrecto. • https://www.qualcomm.com/company/product-security/bulletins/august-2023-bulletin • CWE-823: Use of Out-of-range Pointer Offset CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') •
CVSS: 8.4EPSS: 0%CPEs: 366EXPL: 0CVE-2023-28537 – Integer Overflow or Wraparound in Audio
https://notcve.org/view.php?id=CVE-2023-28537
08 Aug 2023 — Memory corruption while allocating memory in COmxApeDec module in Audio. Corrupción de memoria al asignar memoria en el módulo COmxApeDec en Audio. • https://www.qualcomm.com/company/product-security/bulletins/august-2023-bulletin • CWE-190: Integer Overflow or Wraparound CWE-787: Out-of-bounds Write •
CVSS: 8.4EPSS: 0%CPEs: 344EXPL: 0CVE-2023-22666 – Integer Overflow or Wraparound in Audio
https://notcve.org/view.php?id=CVE-2023-22666
08 Aug 2023 — Memory Corruption in Audio while playing amrwbplus clips with modified content. Corrupción de memoria en audio al reproducir clips amrwbplus con contenido modificado. • https://www.qualcomm.com/company/product-security/bulletins/august-2023-bulletin • CWE-190: Integer Overflow or Wraparound CWE-787: Out-of-bounds Write •