CVE Vulnerability Catalog

In Qualcomm products with Android releases from CAF, during the wlan calibration data store and retrieve operation, there are potential race conditions that lead to a memory leak and a buffer overflow during the context switch.

In Qualcomm products with Android releases from CAF, while reading audio data from an unspecified driver, a buffer overflow or integer overflow could occur.

In Qualcomm products with Android releases from CAF, in the function msm_dba_register_client, there is an issue where if client registration fails, the client is freed but not removed from the list. This can lead to a use-after-free situation when traversing the list next time.

In Qualcomm products with Android releases from CAF, in functions msm_isp_check_stream_cfg_cmd and msm_isp_stats_update_cgc_override, the value 'stream_cfg_cmd->num_streams' is not checked, which could lead to an overflow of the array stream_cfg_cmd->stream_handle.

In Qualcomm products with Android releases from CAF, user controlled variables 'nr_cmds' and 'nr_bos' are passed across functions without any checks. This may lead to buffer overflow when the values are too large or negative.

In Qualcomm products with Android releases from CAF, there is an issue with multiple threads performing the device open operation. This may lead to get_pid being called multiple times, while put_pid is called only once.

All Qualcomm products with Android releases from CAF using the Linux kernel have an issue where an output buffer is accessed in one thread and can be potentially freed in another.

All Qualcomm products with Android releases from CAF using the Linux kernel have an issue in an ISP Camera kernel driver function where an incorrect bounds check may lead to an out-of-bounds write.

All Qualcomm products with Android releases from CAF using the Linux kernel may be susceptible to memory corruption. This issue occurs during concurrent calls into ioctl RMNET_IOCTL_ADD_MUX_CHANNEL in the ipa wan driver due to missing locks.

In Qualcomm products with Android releases from CAF, in the audio_aio_ion_lookup_vaddr function, the buffer length provided by the user is used to validate if the buffer is within the valid region. If the buffer length is large enough, the address + length operation could overflow and produce a result far below the valid region.

All Qualcomm products with Android releases from CAF using the Linux kernel have a vulnerability that allows writing to a PCIe register via a debugfs node, potentially leading to kernel memory corruption.

The bark_noise_hybridmp function in psy.c in Xiph.Org libvorbis 1.3.5 allows remote attackers to cause a denial of service (out-of-bounds access and application crash) or possibly have unspecified other impact via a crafted mp4 file.

The knife bootstrap command in Chef Infra client before version 15.4.45 leaks the private RSA key validator.pem to /var/log/messages.

A cross-site request forgery (CSRF) vulnerability exists in Kallithea before version 0.2. An attacker can exploit this flaw to perform unauthorized actions on behalf of an authenticated user.

In Open Ticket Request System (OTRS) versions 3.3.x before 3.3.18, 4.x before 4.0.25, and 5.x before 5.0.23, remote authenticated users can leverage statistics-write permissions to gain privileges via code injection.

An out of bounds read in the function d2ulaw_array() in libsndfile version 1.0.28 may lead to a remote DoS attack or information disclosure, related to mishandling of the NAN and INFINITY floating-point values.

An out of bounds read in the function d2alaw_array() in libsndfile version 1.0.28 may lead to a remote DoS attack or information disclosure, related to mishandling of the NAN and INFINITY floating-point values.

In sam2p version 0.49.3, there is an integer signedness error in the in_xpm_reader function in in_xpm.cpp, leading to a crash when writing to an out-of-bounds array element.

A vulnerability in the Cisco Unified Intelligence Center allows an unauthenticated, remote attacker to execute unwanted actions. The issue is due to a lack of cross-site request forgery (CSRF) protection.

A vulnerability in the Cisco FindIT Network Discovery Utility could allow an authenticated, local attacker to perform a DLL preloading attack, potentially causing a partial impact to device availability, confidentiality, and integrity.