SB2022020501 - Multiple vulnerabilities in Unisoc chipsets

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Missing Authorization (CVE-ID: CVE-2021-39636)

The vulnerability allows a remote attacker to read, manipulate or delete data.

The vulnerability exists due to improper input validation within the net service in System. A remote attacker can trick the victim to open a specially crafted file and read, manipulate or delete data.

2) Missing Authorization (CVE-ID: CVE-2021-39635)

The vulnerability allows a remote attacker to read, manipulate or delete data.

The vulnerability exists due to improper input validation within the net service in System. A remote attacker can trick the victim to open a specially crafted file and read, manipulate or delete data.

3) Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CVE-ID: CVE-2021-39616)

The vulnerability allows a remote attacker to read, manipulate or delete data.

The vulnerability exists due to improper input validation within the System. A remote attacker can trick the victim to open a specially crafted file and read, manipulate or delete data.

Remediation

Install update from vendor's website.

References

• https://www.unisoc.com/en_us/secy/announcementDetail/1532206380499406850