SB2023090427 - Multiple vulnerabilities in Qualcomm chipsets
Published: September 4, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 35 secuirty vulnerabilities.
1) Reachable Assertion (CVE-ID: CVE-2023-21653)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation in Modem. A remote attacker can perform a denial of service (DoS) attack.
2) Memory corruption (CVE-ID: CVE-2023-21663)
The vulnerability allows a local privileged application to execute arbitrary code.
The vulnerability exists due to improper input validation in Display. A local privileged application can execute arbitrary code.
3) Buffer over-read (CVE-ID: CVE-2023-21667)
The vulnerability allows a remote application to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation in Bluetooth HOST. A remote application can perform a denial of service (DoS) attack.
4) Buffer overflow (CVE-ID: CVE-2023-28562)
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to improper input validation in QESL. A remote attacker can execute arbitrary code.
5) Memory corruption (CVE-ID: CVE-2023-28581)
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to improper input validation in WLAN Firmware. A remote attacker can execute arbitrary code.
6) Improper Validation of Array Index (CVE-ID: CVE-2022-40534)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Audio. A local application can execute arbitrary code.
7) Reachable Assertion (CVE-ID: CVE-2023-21646)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation in Modem. A remote attacker can perform a denial of service (DoS) attack.
8) Buffer overflow (CVE-ID: CVE-2023-21662)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Core Platform. A local application can execute arbitrary code.
9) Memory corruption (CVE-ID: CVE-2023-21654)
The vulnerability allows a local privileged application to execute arbitrary code.
The vulnerability exists due to improper input validation in Audio. A local privileged application can execute arbitrary code.
10) Buffer overflow (CVE-ID: CVE-2023-21664)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Core Platform. A local application can execute arbitrary code.
11) Stack-based buffer overflow (CVE-ID: CVE-2023-28538)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in WIN Product. A local application can execute arbitrary code.
12) Improper Validation of Array Index (CVE-ID: CVE-2023-28548)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in WLAN HAL. A local application can execute arbitrary code.
13) Memory corruption (CVE-ID: CVE-2023-28549)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in WLAN HAL. A local application can execute arbitrary code.
14) Buffer over-read (CVE-ID: CVE-2023-33015)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation in WLAN Firmware. A remote attacker can perform a denial of service (DoS) attack.
15) Buffer over-read (CVE-ID: CVE-2023-33016)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation in WLAN Firmware. A remote attacker can perform a denial of service (DoS) attack.
16) Use After Free (CVE-ID: CVE-2023-33021)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Graphics. A local application can execute arbitrary code.
17) Integer overflow (CVE-ID: CVE-2023-21655)
The vulnerability allows a local privileged application to execute arbitrary code.
The vulnerability exists due to improper input validation in Display. A local privileged application can execute arbitrary code.
18) Integer overflow (CVE-ID: CVE-2023-21644)
The vulnerability allows a local privileged application to execute arbitrary code.
The vulnerability exists due to improper input validation in RIL. A local privileged application can execute arbitrary code.
19) Improper Validation of Array Index (CVE-ID: CVE-2022-33275)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in WLAN HAL. A local application can execute arbitrary code.
20) Improper Validation of Array Index (CVE-ID: CVE-2023-28565)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in WLAN HAL. A local application can execute arbitrary code.
21) Buffer overflow (CVE-ID: CVE-2023-28544)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in WLAN Firmware. A local application can execute arbitrary code.
22) Improper Validation of Array Index (CVE-ID: CVE-2023-28557)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in WLAN HAL. A local application can execute arbitrary code.
23) Improper Validation of Array Index (CVE-ID: CVE-2023-28558)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in WLAN HAL. A local application can execute arbitrary code.
24) Buffer overflow (CVE-ID: CVE-2023-28559)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in WLAN HAL. A local application can execute arbitrary code.
25) Buffer overflow (CVE-ID: CVE-2023-28560)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in WLAN HAL. A local application can execute arbitrary code.
26) Use of Out-of-range Pointer Offset (CVE-ID: CVE-2023-28564)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in WLAN HAL. A local application can execute arbitrary code.
27) Improper Validation of Array Index (CVE-ID: CVE-2023-28567)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in WLAN HAL. A local application can execute arbitrary code.
28) Improper Validation of Array Index (CVE-ID: CVE-2023-21636)
The vulnerability allows a local privileged application to execute arbitrary code.
The vulnerability exists due to improper input validation in Linux. A local privileged application can execute arbitrary code.
29) Out-of-bounds read (CVE-ID: CVE-2023-28543)
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to improper input validation in SNPE Library. A remote attacker can execute arbitrary code.
30) Improper Validation of Array Index (CVE-ID: CVE-2023-28573)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in WLAN HAL. A local application can execute arbitrary code.
31) Improper Authorization (CVE-ID: CVE-2023-28584)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation in WLAN Host. A remote attacker can perform a denial of service (DoS) attack.
32) Improper Authorization (CVE-ID: CVE-2023-33019)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation in WLAN Host. A remote attacker can perform a denial of service (DoS) attack.
33) Improper Authorization (CVE-ID: CVE-2023-33020)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation in WLAN Host. A remote attacker can perform a denial of service (DoS) attack.
34) Buffer over-read (CVE-ID: CVE-2022-33220)
The vulnerability allows a local privileged application to read and manipulate data.
The vulnerability exists due to improper input validation in Automotive multimedia. A local privileged application can read and manipulate data.
35) Buffer over-read (CVE-ID: CVE-2022-40524)
The vulnerability allows a local privileged application to execute arbitrary code.
The vulnerability exists due to improper input validation in Modem. A local privileged application can execute arbitrary code.
Remediation
Install update from vendor's website.