SB2024110464 - Multiple vulnerabilities in Qualcomm chipsets
Published: November 4, 2024
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 22 secuirty vulnerabilities.
1) Use After Free (CVE-ID: CVE-2024-33033)
The vulnerability allows a local privileged application to execute arbitrary code.
The vulnerability exists due to improper input validation in ComputerVision. A local privileged application can execute arbitrary code.
2) Buffer over-read (CVE-ID: CVE-2024-38405)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation in WLAN Host. A remote attacker can perform a denial of service (DoS) attack.
3) Use After Free (CVE-ID: CVE-2024-33068)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation in WLAN Host Communication. A remote attacker can perform a denial of service (DoS) attack.
4) Use After Free (CVE-ID: CVE-2024-38424)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in GPS. A local application can execute arbitrary code.
5) Stack-based buffer overflow (CVE-ID: CVE-2024-38410)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in WLAN Windows Host. A local application can execute arbitrary code.
6) Buffer overflow (CVE-ID: CVE-2024-38409)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in WLAN Windows Host. A local application can execute arbitrary code.
7) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2024-38407)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Camera. A local application can execute arbitrary code.
8) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2024-38406)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Camera. A local application can execute arbitrary code.
9) Buffer over-read (CVE-ID: CVE-2024-38403)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation in WLAN Firmware. A remote attacker can perform a denial of service (DoS) attack.
10) Cryptographic Issues (CVE-ID: CVE-2024-38408)
The vulnerability allows a remote attacker to read and manipulate data.
The vulnerability exists due to improper input validation in BT Controller. A remote attacker can read and manipulate data.
11) Improper Validation of Array Index (CVE-ID: CVE-2024-33032)
The vulnerability allows a local privileged application to execute arbitrary code.
The vulnerability exists due to improper input validation in Camera_Linux. A local privileged application can execute arbitrary code.
12) Reachable Assertion (CVE-ID: CVE-2024-23385)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation in Modem. A remote attacker can perform a denial of service (DoS) attack.
13) Buffer overflow (CVE-ID: CVE-2024-33030)
The vulnerability allows a local privileged application to execute arbitrary code.
The vulnerability exists due to improper input validation in Performance. A local privileged application can execute arbitrary code.
14) Input validation error (CVE-ID: CVE-2024-33031)
The vulnerability allows a local privileged application to execute arbitrary code.
The vulnerability exists due to improper input validation in RIL. A local privileged application can execute arbitrary code.
15) Input validation error (CVE-ID: CVE-2024-23386)
The vulnerability allows a local privileged application to execute arbitrary code.
The vulnerability exists due to improper input validation in Video. A local privileged application can execute arbitrary code.
16) Buffer overflow (CVE-ID: CVE-2024-38423)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Graphics Linux. A local application can execute arbitrary code.
17) Use After Free (CVE-ID: CVE-2024-33029)
The vulnerability allows a local privileged application to execute arbitrary code.
The vulnerability exists due to improper input validation in DSP Services. A local privileged application can execute arbitrary code.
18) Use After Free (CVE-ID: CVE-2024-38421)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Graphics Linux. A local application can execute arbitrary code.
19) Integer overflow (CVE-ID: CVE-2024-38422)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Audio. A local application can execute arbitrary code.
20) Use After Free (CVE-ID: CVE-2024-38419)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Automotive GPU. A local application can execute arbitrary code.
21) Use of Out-of-range Pointer Offset (CVE-ID: CVE-2024-23377)
The vulnerability allows a local privileged application to execute arbitrary code.
The vulnerability exists due to improper input validation in ComputerVision. A local privileged application can execute arbitrary code.
22) Use After Free (CVE-ID: CVE-2024-38415)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to improper input validation in Computer Vision. A local application can execute arbitrary code.
Remediation
Install update from vendor's website.