deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-45940
Published: 2022-01-01
Description: libbpf 0.6.0 and 0.6.1 has a heap-based buffer overflow (4 bytes) in __bpf_object__open (called from bpf_object__open_mem and bpf-object-fuzzer.c).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40868; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libbpf/OSV-2021-1562.yaml; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40868
CVE: CVE-2021-45941
Published: 2022-01-01
Description: libbpf 0.6.0 and 0.6.1 has a heap-based buffer overflow (8 bytes) in __bpf_object__open (called from bpf_object__open_mem and bpf-object-fuzzer.c).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40957; https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libbpf/OSV-2021-1576.yaml; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40957
CVE: CVE-2021-45942
Published: 2022-01-01
Description: OpenEXR 3.1.x before 3.1.4 has a heap-based buffer overflow in Imf_3_1::LineCompositeTask::execute (called from IlmThread_3_1::NullThreadPoolProvider::addTask and IlmThread_3_1::ThreadPool::addGlobalTask). NOTE: db217f2 may be inapplicable.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=41416; https://github.com/AcademySoftwareFoundation/openexr/blob/v3.1.4/CHANGES.md#version-314-january-26-2022; https://github.com/AcademySoftwareFoundation/openexr/commit/11cad77da87c4fa2aab7d58dd5339e254db7937e
CVE: CVE-2021-45943
Published: 2022-01-01
Description: GDAL 3.3.0 through 3.4.0 has a heap-based buffer overflow in PCIDSK::CPCIDSKFile::ReadFromFile (called from PCIDSK::CPCIDSKSegment::ReadFromFile and PCIDSK::CPCIDSKBinarySegment::CPCIDSKBinarySegment).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=41993; https://github.com/OSGeo/gdal/commit/1ca6a3e5168c200763fa46d8aa7e698d0b757e7e; https://github.com/OSGeo/gdal/pull/4944
CVE: CVE-2021-41817
Published: 2022-01-01
Description: Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333
References: https://hackerone.com/reports/1254844; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF/
CVE: CVE-2021-44716
Published: 2022-01-01
Description: net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://cert-portal.siemens.com/productcert/pdf/ssa-744259.pdf; https://groups.google.com/g/golang-announce/c/hcmEScgc00k; https://lists.debian.org/debian-lts-announce/2022/01/msg00016.html
CVE: CVE-2021-44717
Published: 2022-01-01
Description: Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an unintended file or unintended network connection as a consequence of erroneous closing of file descriptor 0 after file-descriptor exhaustion.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-404
References: https://cert-portal.siemens.com/productcert/pdf/ssa-744259.pdf; https://groups.google.com/g/golang-announce/c/hcmEScgc00k; https://lists.debian.org/debian-lts-announce/2022/01/msg00016.html
CVE: CVE-2021-41819
Published: 2022-01-01
Description: CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.
CVSS Score: 7.5 (HIGH)
CWE: CWE-565, CWE-565
References: https://hackerone.com/reports/910552; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF/
CVE: CVE-2021-43333
Published: 2022-01-01
Description: The Datalogic DXU service on (for example) DL-Axist devices does not require authentication for configuration changes or disclosure of configuration settings.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-306
References: https://datalogic.github.io/dxu/security; https://developer.datalogic.com/upload/res/ds/adc/dl-axist/DS-DL-AXIST-ENA4.pdf; https://datalogic.github.io/dxu/security
CVE: CVE-2021-44852
Published: 2022-01-01
Description: An issue was discovered in BS_RCIO64.sys in Biostar RACING GT Evo 2.1.1905.1700. A low-integrity process can open the driver's device object and issue IOCTLs to read or write to arbitrary physical memory locations (or call an arbitrary address), leading to execution of arbitrary code. This is associated with 0x226040, 0x226044, and 0x226000.
CVSS Score: 7.8 (HIGH)
References: https://nephosec.com/biostar-exploit/; https://nephosec.com/biostar-exploit/
CVE: CVE-2021-45960
Published: 2022-01-01
Description: In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).
CVSS Score: 8.8 (HIGH)
CWE: CWE-682, CWE-682
References: http://www.openwall.com/lists/oss-security/2022/01/17/3; https://bugzilla.mozilla.org/show_bug.cgi?id=1217609; https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
CVE: CVE-2021-45972
Published: 2022-01-01
Description: The giftrans function in giftrans 1.12.2 contains a stack-based buffer overflow because a value inside the input file determines the amount of data to write. This allows an attacker to overwrite up to 250 bytes outside of the allocated buffer with arbitrary data.
CVSS Score: 7.1 (HIGH)
CWE: CWE-1284
References: http://web.archive.org/web/[PII_REDACTED]5019/; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1002739; https://www.abdn.ac.uk/tools/ibmpc/giftrans/index.hti
CVE: CVE-2021-44896
Published: 2022-01-01
Description: DMP Roadmap before 3.0.4 allows XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/DMPRoadmap/roadmap/commit/0b83ad31ac01a709633080b134cfb6debc310c5e; https://github.com/DMPRoadmap/roadmap/compare/v3.0.3...v3.0.4; https://github.com/DMPRoadmap/roadmap/pull/3030
CVE: CVE-2022-22293
Published: 2022-01-02
Description: admin/limits.php in Dolibarr 7.0.2 allows HTML injection, as demonstrated by the MAIN_MAX_DECIMALS_TOT parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Dolibarr/dolibarr/issues/20237; https://github.com/mustgundogdu/Research/blob/main/Dolibar_7.0.2-StoredXSS/README.md; https://github.com/Dolibarr/dolibarr/issues/20237
CVE: CVE-2022-0080
Published: 2022-01-02
Description: mruby is vulnerable to Heap-based Buffer Overflow
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-122, CWE-122
References: https://github.com/mruby/mruby/commit/28ccc664e5dcd3f9d55173e9afde77c4705a9ab6; https://huntr.dev/bounties/59a70392-4864-4ce3-8e35-6ac2111d1e2e; https://github.com/mruby/mruby/commit/28ccc664e5dcd3f9d55173e9afde77c4705a9ab6
CVE: CVE-2021-36751
Published: 2022-01-02
Description: ENC DataVault 7.2.3 and before, and OEM versions, use an encryption algorithm that is vulnerable to data manipulation (without knowledge of the key). This is called ciphertext malleability. There is no data integrity mechanism to detect this manipulation.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-345
References: https://encsecurity.zendesk.com/hc/en-us/articles/[PII_REDACTED]265-Update-for-ENC-Software; https://encsecurity.zendesk.com/hc/en-us/articles/[PII_REDACTED]533; https://pretalx.c3voc.de/rc3-2021-r3s/talk/QMYGR3/
CVE: CVE-2022-0079
Published: 2022-01-03
Description: showdoc is vulnerable to Generation of Error Message Containing Sensitive Information
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://github.com/star7th/showdoc/commit/e43df0a190f68aefa272507d3bd54475f566c1db; https://huntr.dev/bounties/b37f0e26-355a-4d50-8495-a567c10828ee; https://github.com/star7th/showdoc/commit/e43df0a190f68aefa272507d3bd54475f566c1db
CVE: CVE-2021-25981
Published: 2022-01-03
Description: In Talkyard, regular versions v0.2021.20 through v0.2021.33 and dev versions v0.2021.20 through v0.2021.34, are vulnerable to Insufficient Session Expiration. This may allow an attacker to reuse the admin’s still-valid session token even when logged-out, to gain admin privileges, given the attacker is able to obtain that token (via other, hypothetical attacks)
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-613, CWE-613
References: https://github.com/debiki/talkyard/commit/b0310df019887f[PII_REDACTED]c773bc7d85ddcf34; https://github.com/debiki/talkyard/commit/b0712915d8a22a20b09a129924e8a29c25ae5761; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25981
CVE: CVE-2021-25994
Published: 2022-01-03
Description: In Userfrosting, versions v0.3.1 to v4.6.2 are vulnerable to Host Header Injection. By luring a victim application user to click on a link, an unauthenticated attacker can use the “forgot password” functionality to reset the victim’s password and successfully take over their account.
CVSS Score: 8.8 (HIGH)
CWE: CWE-74, CWE-74
References: https://github.com/userfrosting/UserFrosting/commit/796dd[PII_REDACTED]5d1bd286415feea78098e45ba; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25994; https://github.com/userfrosting/UserFrosting/commit/796dd[PII_REDACTED]5d1bd286415feea78098e45ba
CVE: CVE-2020-11263
Published: 2022-01-03
Description: An integer overflow due to improper check performed after the address and size passed are aligned in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking
CVSS Score: 7.3 (HIGH)
CWE: CWE-190
References: https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin
CVE: CVE-2021-1894
Published: 2022-01-03
Description: Improper access control in TrustZone due to improper error handling while handling the signing key in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
CVSS Score: 7.1 (HIGH)
CWE: CWE-755
References: https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin
CVE: CVE-2021-1918
Published: 2022-01-03
Description: Improper handling of resource allocation in virtual machines can lead to information exposure in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-668, CWE-668
References: https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin
CVE: CVE-2021-30262
Published: 2022-01-03
Description: Improper validation of a socket state when socket events are being sent to clients can lead to invalid access of memory in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 8.4 (HIGH)
CWE: CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin
CVE: CVE-2021-30267
Published: 2022-01-03
Description: Possible integer overflow to buffer overflow due to improper input validation in FTM ARA commands in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin
CVE: CVE-2021-30268
Published: 2022-01-03
Description: Possible heap Memory Corruption Issue due to lack of input validation when sending HWTC IQ Capture command in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin
CVE: CVE-2021-30269
Published: 2022-01-03
Description: Possible null pointer dereference due to lack of TLB validation for user provided address in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
CVSS Score: 7.3 (HIGH)
CWE: CWE-476
References: https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin
CVE: CVE-2021-30270
Published: 2022-01-03
Description: Possible null pointer dereference in thread profile trap handler due to lack of thread ID validation before dereferencing it in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVSS Score: 7.3 (HIGH)
CWE: CWE-476
References: https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin
CVE: CVE-2021-30271
Published: 2022-01-03
Description: Possible null pointer dereference in trap handler due to lack of thread ID validation before dereferencing it in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVSS Score: 7.3 (HIGH)
CWE: CWE-476
References: https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin
CVE: CVE-2021-30272
Published: 2022-01-03
Description: Possible null pointer dereference in thread cache operation handler due to lack of validation of user provided input in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVSS Score: 7.3 (HIGH)
CWE: CWE-476
References: https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin
CVE: CVE-2021-30273
Published: 2022-01-03
Description: Possible assertion due to improper handling of IPV6 packet with invalid length in destination options header in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Wearables
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin
CVE: CVE-2021-30274
Published: 2022-01-03
Description: Possible integer overflow in access control initialization interface due to lack and size and address validation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
CVSS Score: 8.4 (HIGH)
CWE: CWE-190
References: https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin
CVE: CVE-2021-30275
Published: 2022-01-03
Description: Possible integer overflow in page alignment interface due to lack of address and size validation before alignment in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-190
References: https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin
CVE: CVE-2021-30276
Published: 2022-01-03
Description: Improper access control while doing XPU re-configuration dynamically can lead to unauthorized access to a secure resource in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Wired Infrastructure and Networking
CVSS Score: 9.3 (CRITICAL)
References: https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin
CVE: CVE-2021-30278
Published: 2022-01-03
Description: Improper input validation in TrustZone memory transfer interface can lead to information disclosure in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin
CVE: CVE-2021-30279
Published: 2022-01-03
Description: Possible access control violation while setting current permission for VMIDs due to improper permission masking in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking
CVSS Score: 7.8 (HIGH)
CWE: CWE-281
References: https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin
CVE: CVE-2021-30282
Published: 2022-01-03
Description: Possible out of bound write in RAM partition table due to improper validation on number of partitions provided in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
CVSS Score: 8.4 (HIGH)
CWE: CWE-129
References: https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin
CVE: CVE-2021-30283
Published: 2022-01-03
Description: Possible denial of service due to improper handling of debug register trap from user applications in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
CVSS Score: 7.1 (HIGH)
CWE: CWE-755
References: https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin
CVE: CVE-2021-30289
Published: 2022-01-03
Description: Possible buffer overflow due to lack of range check while processing a DIAG command for COEX management in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin
CVE: CVE-2021-30293
Published: 2022-01-03
Description: Possible assertion due to lack of input validation in PUSCH configuration in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin
CVE: CVE-2021-30298
Published: 2022-01-03
Description: Possible out of bound access due to improper validation of item size and DIAG memory pools data while switching between USB and PCIE interface in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin
CVE: CVE-2021-30303
Published: 2022-01-03
Description: Possible buffer overflow due to lack of buffer length check when segmented WMI command is received in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin
CVE: CVE-2021-30335
Published: 2022-01-03
Description: Possible assertion in QOS request due to improper validation when multiple add or update request are received simultaneously in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVSS Score: 8.4 (HIGH)
CWE: CWE-617
References: https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin
CVE: CVE-2021-30336
Published: 2022-01-03
Description: Possible out of bound read due to lack of domain input validation while processing APK close session request in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Wearables
CVSS Score: 8.4 (HIGH)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin
CVE: CVE-2021-30337
Published: 2022-01-03
Description: Possible use after free when process shell memory is freed using IOCTL call and process initialization is in progress in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVSS Score: 8.4 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin
CVE: CVE-2021-30348
Published: 2022-01-03
Description: Improper validation of LLM utility timers availability can lead to denial of service in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2021-bulletin