deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-53072
Published: 2024-11-19
Description: In the Linux kernel, the following vulnerability has been resolved:

platform/x86/amd/pmc: Detect when STB is not available

Loading the amd_pmc module as:

    amd_pmc enable_stb=1

...can result in the following messages in the kernel ring buffer:

    amd_pmc AMDI0009:00: SMU cmd failed. err: 0xff
    ioremap on RAM at 0x[PII_REDACTED]000000 - 0x[PII_REDACTED]ffffff
    WARNING: CPU: 10 PID: 2151 at arch/x86/mm/ioremap.c:217 __ioremap_caller+0x2cd/0x340

Further debugging reveals that this occurs when the requests for
S2D_PHYS_ADDR_LOW and S2D_PHYS_ADDR_HIGH return a value of 0,
indicating that the STB is inaccessible. To prevent the ioremap
warning and provide clarity to the user, handle the invalid address
and display an error message.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/67ff30e24a0466bdd5be1d0b84385ec3c85fdacd; https://git.kernel.org/stable/c/7a3ed3f125292bc3398e04d[PII_REDACTED]892e3f; https://git.kernel.org/stable/c/a50863dd1f92d43c975ab2ecc3476617fe98a66e
CVE: CVE-2024-53073
Published: 2024-11-19
Description: In the Linux kernel, the following vulnerability has been resolved:

NFSD: Never decrement pending_async_copies on error

The error flow in nfsd4_copy() calls cleanup_async_copy(), which
already decrements nn->pending_async_copies.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/1421883aa30c5d26bc3370e2d19cb350f0d5ca28; https://git.kernel.org/stable/c/8286f8b[PII_REDACTED]07df9ab852e0f87c60d35e9; https://git.kernel.org/stable/c/9467c49437e948c541569007cd412d577942e635
CVE: CVE-2024-53074
Published: 2024-11-19
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mvm: don't leak a link on AP removal

Release the link mapping resource in AP removal. This impacted devices
that do not support the MLD API (9260 and down).
On those devices, we couldn't start the AP again after the AP has been
already started and stopped.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-772, CWE-772
References: https://git.kernel.org/stable/c/3ed092997a004d68a3a5b0eeb94e71b69839d0f7; https://git.kernel.org/stable/c/70ddf9ce1894c48dbbf10b0de51a95e4fb3dd376
CVE: CVE-2024-53075
Published: 2024-11-19
Description: In the Linux kernel, the following vulnerability has been resolved:

riscv: Prevent a bad reference count on CPU nodes

When populating cache leaves we previously fetched the CPU device node
at the very beginning. But when ACPI is enabled we go through a
specific branch which returns early and does not call 'of_node_put' for
the node that was acquired.

Since we are not using a CPU device node for the ACPI code anyways, we
can simply move the initialization of it just passed the ACPI block, and
we are guaranteed to have an 'of_node_put' call for the acquired node.
This prevents a bad reference count of the CPU device node.

Moreover, the previous function did not check for errors when acquiring
the device node, so a return -ENOENT has been added for that case.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/303846a3dc275e35fbb556d72f1e356ba669e4f8; https://git.kernel.org/stable/c/37233169a6ea912020c572f870075a63293b786a; https://git.kernel.org/stable/c/80aec5a855106c668b5978c48e789f010198b832
CVE: CVE-2024-53076
Published: 2024-11-19
Description: In the Linux kernel, the following vulnerability has been resolved:

iio: gts-helper: Fix memory leaks for the error path of iio_gts_build_avail_scale_table()

If per_time_scales[i] or per_time_gains[i] kcalloc fails in the for loop
of iio_gts_build_avail_scale_table(), the err_free_out will fail to call
kfree() each time when i is reduced to 0, so all the per_time_scales[0]
and per_time_gains[0] will not be freed, which will cause memory leaks.

Fix it by checking if i >= 0.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://git.kernel.org/stable/c/369f05688911b05216cfcd6ca74473bec87948d7; https://git.kernel.org/stable/c/62c[PII_REDACTED]790b8f5ab6eb7e695818b0b723; https://git.kernel.org/stable/c/b304362ce836968b803e5d4c5f84dcb51a7bf0f2
CVE: CVE-2024-53077
Published: 2024-11-19
Description: In the Linux kernel, the following vulnerability has been resolved:

rpcrdma: Always release the rpcrdma_device's xa_array

Dai pointed out that the xa_init_flags() in rpcrdma_add_one() needs
to have a matching xa_destroy() in rpcrdma_remove_one() to release
underlying memory that the xarray might have accrued during
operation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://git.kernel.org/stable/c/36b7f5a4f300d[PII_REDACTED]40ff7c[PII_REDACTED]d; https://git.kernel.org/stable/c/63a81588cd2025e75fbaf30b65930b76825c456f
CVE: CVE-2024-53078
Published: 2024-11-19
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/tegra: Fix NULL vs IS_ERR() check in probe()

The iommu_paging_domain_alloc() function doesn't  return NULL pointers,
it returns error pointers.  Update the check to match.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/6d6c005855b97b8caf6039c1774745ee74c91fa6; https://git.kernel.org/stable/c/a85df8c7b5ee2d3d4823befada42c5c41aff4cb0
CVE: CVE-2024-53080
Published: 2024-11-19
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/panthor: Lock XArray when getting entries for the VM

Similar to commit cac075706f29 ("drm/panthor: Fix race when converting
group handle to group object") we need to use the XArray's internal
locking when retrieving a vm pointer from there.

v2: Removed part of the patch that was trying to protect fetching
the heap pointer from XArray, as that operation is protected by
the @pool->lock.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: https://git.kernel.org/stable/c/3342f066a8e1020a6f7d1fbd6b23bfdeda473eb5; https://git.kernel.org/stable/c/444fa5b100e5c90550d6bccfe4476efb0391b3ca; https://project-zero.issues.chromium.org/issues/377500597
CVE: CVE-2024-53081
Published: 2024-11-19
Description: In the Linux kernel, the following vulnerability has been resolved:

media: ar0521: don't overflow when checking PLL values

The PLL checks are comparing 64 bit integers with 32 bit
ones, as reported by Coverity. Depending on the values of
the variables, this may underflow.

Fix it ensuring that both sides of the expression are u64.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-191, CWE-191
References: https://git.kernel.org/stable/c/438d3085ba5b8b5bfa5290faa594e577f6ac9aa7; https://git.kernel.org/stable/c/5e1523076acf95b4ea68d19b6f27e6891267cc24; https://git.kernel.org/stable/c/97ed0c0332d[PII_REDACTED]b31acf62ff1e6b50784
CVE: CVE-2024-53082
Published: 2024-11-19
Description: In the Linux kernel, the following vulnerability has been resolved:

virtio_net: Add hash_key_length check

Add hash_key_length check in virtnet_probe() to avoid possible out of
bound errors when setting/reading the hash key.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125, CWE-125
References: https://git.kernel.org/stable/c/3f7d9c1964fcd16d02a8a9d4fd6f6cb60c4cc530; https://git.kernel.org/stable/c/6a18a783b1fa590ad1ed785907263e4b86adcfe2; https://git.kernel.org/stable/c/af0aa8aecbe[PII_REDACTED]902894cc4cb62795691
CVE: CVE-2024-53083
Published: 2024-11-19
Description: In the Linux kernel, the following vulnerability has been resolved:

usb: typec: qcom-pmic: init value of hdr_len/txbuf_len earlier

If the read of USB_PDPHY_RX_ACKNOWLEDGE_REG failed, then hdr_len and
txbuf_len are uninitialized. This commit stops to print uninitialized
value and misleading/false data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908, CWE-908
References: https://git.kernel.org/stable/c/029778a4fd2c90c2e76a902b797c2348a722f1b8; https://git.kernel.org/stable/c/35925e2b7b404cad3db857434d3312b892b55432; https://git.kernel.org/stable/c/74d8cee747b37cd9f5ca631f678e66e7f40f2b5f
CVE: CVE-2024-53084
Published: 2024-11-19
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/imagination: Break an object reference loop

When remaining resources are being cleaned up on driver close,
outstanding VM mappings may result in resources being leaked, due
to an object reference loop, as shown below, with each object (or
set of objects) referencing the object below it:

    PVR GEM Object
    GPU scheduler "finished" fence
    GPU scheduler “scheduled” fence
    PVR driver “done” fence
    PVR Context
    PVR VM Context
    PVR VM Mappings
    PVR GEM Object

The reference that the PVR VM Context has on the VM mappings is a
soft one, in the sense that the freeing of outstanding VM mappings
is done as part of VM context destruction; no reference counts are
involved, as is the case for all the other references in the loop.

To break the reference loop during cleanup, free the outstanding
VM mappings before destroying the PVR Context associated with the
VM context.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://git.kernel.org/stable/c/b04ce1e718bd55302b52d05d6873e233cb3ec7a1; https://git.kernel.org/stable/c/cb86db12b290ed07d05df00d99fa150bb123e80e
CVE: CVE-2024-53085
Published: 2024-11-19
Description: In the Linux kernel, the following vulnerability has been resolved:

tpm: Lock TPM chip in tpm_pm_suspend() first

Setting TPM_CHIP_FLAG_SUSPENDED in the end of tpm_pm_suspend() can be racy
according, as this leaves window for tpm_hwrng_read() to be called while
the operation is in progress. The recent bug report gives also evidence of
this behaviour.

Aadress this by locking the TPM chip before checking any chip->flags both
in tpm_pm_suspend() and tpm_hwrng_read(). Move TPM_CHIP_FLAG_SUSPENDED
check inside tpm_get_random() so that it will be always checked only when
the lock is reserved.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: https://git.kernel.org/stable/c/9265fed6db601ee2ec[PII_REDACTED]7458ef4f047a; https://git.kernel.org/stable/c/bc203fe416abdd1c29da594565a7c3c4e979488e; https://git.kernel.org/stable/c/cfaf83501a0cbb104499c5b0892ee5ebde4e967f
CVE: CVE-2024-53086
Published: 2024-11-19
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/xe: Drop VM dma-resv lock on xe_sync_in_fence_get failure in exec IOCTL

Upon failure all locks need to be dropped before returning to the user.

(cherry picked from commit 7d1a4258e602ffdce529f[PII_REDACTED]4c1b3b095)
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667, CWE-667
References: https://git.kernel.org/stable/c/64a2b6ed4bfd890a0e91955dd8ef8422a3944ed9; https://git.kernel.org/stable/c/96397b1e25dda8389dea63ec914038a170bf953d
CVE: CVE-2024-53087
Published: 2024-11-19
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/xe: Fix possible exec queue leak in exec IOCTL

In a couple of places after an exec queue is looked up the exec IOCTL
returns on input errors without dropping the exec queue ref. Fix this
ensuring the exec queue ref is dropped on input error.

(cherry picked from commit 07064a200b40ac2195cb6b7b779897d9377e5e6f)
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://git.kernel.org/stable/c/2f92b77a8ce043fbda2664d9be4b66bdc57f67b7; https://git.kernel.org/stable/c/af797b831d8975cb4610f396dcb7f03f4b9908e7
CVE: CVE-2024-53088
Published: 2024-11-19
Description: In the Linux kernel, the following vulnerability has been resolved:

i40e: fix race condition by adding filter's intermediate sync state

Fix a race condition in the i40e driver that leads to MAC/VLAN filters
becoming corrupted and leaking. Address the issue that occurs under
heavy load when multiple threads are concurrently modifying MAC/VLAN
filters by setting mac and port VLAN.

1. Thread T0 allocates a filter in i40e_add_filter() within
        i40e_ndo_set_vf_port_vlan().
2. Thread T1 concurrently frees the filter in __i40e_del_filter() within
        i40e_ndo_set_vf_mac().
3. Subsequently, i40e_service_task() calls i40e_sync_vsi_filters(), which
        refers to the already freed filter memory, causing corruption.

Reproduction steps:
1. Spawn multiple VFs.
2. Apply a concurrent heavy load by running parallel operations to change
        MAC addresses on the VFs and change port VLANs on the host.
3. Observe errors in dmesg:
"Error I40E_AQ_RC_ENOSPC adding RX filters on VF XX,
	please set promiscuous on manually for VF XX".

Exact code for stable reproduction Intel can't open-source now.

The fix involves implementing a new intermediate filter state,
I40E_FILTER_NEW_SYNC, for the time when a filter is on a tmp_add_list.
These filters cannot be deleted from the hash list directly but
must be removed using the full process.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362, CWE-362
References: https://git.kernel.org/stable/c/262dc6ea5f1eb18c4d08ad83d51222d0dd0dd42a; https://git.kernel.org/stable/c/6e046f4937474bc1b9fa980c1ad8f3253fc638f6; https://git.kernel.org/stable/c/7ad3fb3bfd43feb4e15c81dffd23ac4e55742791
CVE: CVE-2018-9339
Published: 2024-11-19
Description: In writeTypedArrayList and readTypedArrayList of Parcel.java, there is a possible escalation of privilege due to type confusion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-843, CWE-704
References: https://source.android.com/security/bulletin/2018-06-01
CVE: CVE-2018-9340
Published: 2024-11-19
Description: In ResStringPool::setTo of ResourceTypes.cpp, it's possible for an attacker to control the value of mStringPoolSize to be out of bounds, causing information disclosure.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-787
References: https://source.android.com/security/bulletin/2018-06-01
CVE: CVE-2018-9341
Published: 2024-11-19
Description: In impeg2d_mc_fullx_fully of impeg2d_mc.c there is a possible out of bound write due to missing bounds check. This could lead to remote arbitrary code execution with no additional execution privileges needed. User interaction is needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://source.android.com/security/bulletin/2018-06-01
CVE: CVE-2018-9344
Published: 2024-11-19
Description: In several functions of DescramblerImpl.cpp, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-667, CWE-416
References: https://source.android.com/security/bulletin/2018-06-01
CVE: CVE-2018-9345
Published: 2024-11-19
Description: In BnAudioPolicyService::onTransact of AudioPolicyService.cpp, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908, CWE-908
References: https://source.android.com/security/bulletin/2018-06-01
CVE: CVE-2018-9346
Published: 2024-11-19
Description: In BnAudioPolicyService::onTransact of AudioPolicyService.cpp, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908, CWE-908
References: https://source.android.com/security/bulletin/2018-06-01
CVE: CVE-2024-21697
Published: 2024-11-19
Description: This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 4.2.8 of Sourcetree for Mac and 3.4.19 for Sourcetree for Windows.

This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8.8, allows an unauthenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interaction.

Atlassian recommends that Sourcetree for Mac and Sourcetree for Windows customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:
 Sourcetree for Mac 4.2: Upgrade to a release greater than or equal to 4.2.9
 Sourcetree for Windows 3.4: Upgrade to a release greater than or equal to 3.4.20

See the release notes ([https://www.sourcetreeapp.com/download-archives]). You can download the latest version of Sourcetree for Mac and Sourcetree for Windows from the download center ([https://www.sourcetreeapp.com/download-archives]).

This vulnerability was reported via our Penetration Testing program.
CVSS Score: 8.8 (HIGH)
References: https://confluence.atlassian.com/pages/viewpage.action?pageId=[PII_REDACTED]; https://jira.atlassian.com/browse/SRCTREE-8168
CVE: CVE-2024-48694
Published: 2024-11-19
Description: File Upload vulnerability in Xi'an Daxi Information technology OfficeWeb365 v.8.6.1.0 and v7.18.23.0 allows a remote attacker to execute arbitrary code via the pw/savedraw component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://avd.aliyun.com/detail?id=AVD-2[PII_REDACTED]; https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/32024c5dbb7ff60fa7347cccf6ebb3763a513e7a/docs/wiki/webapp/OfficeWeb365/OfficeWeb365%20SaveDraw%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E.md?plain=1#L24; https://github.com/Threekiii/Vulnerability-Wiki/blob/master/docs-base/docs/webapp/OfficeWeb365-SaveDraw-%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E.md
CVE: CVE-2024-50430
Published: 2024-11-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Beaver Builder Beaver Builder beaver-builder-lite-version allows Stored XSS.This issue affects Beaver Builder: from n/a through <= 2.8.3.7.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/beaver-builder-lite-version/vulnerability/wordpress-beaver-builder-plugin-2-8-3-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-51503
Published: 2024-11-19
Description: A security agent manual scan command injection vulnerability in the Trend Micro Deep Security 20 Agent could allow an attacker to escalate privileges and execute arbitrary code on an affected machine.  In certain circumstances, attackers that have legitimate access to the domain may be able to remotely inject commands to other machines in the same domain.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability locally and must have domain user privileges to affect other machines.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78, CWE-77
References: https://success.trendmicro.com/en-US/solution/KA-0018154; https://www.zerodayinitiative.com/advisories/ZDI-24-1516/
CVE: CVE-2024-52714
Published: 2024-11-19
Description: Tenda AC6 v2.0 v15.03.06.50 was discovered to contain a buffer overflow in the function 'fromSetSysTime.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-120
References: http://tenda.com; https://github.com/CLan-nad/CVE/blob/main/tenda/fromSetSysTime/1.md
CVE: CVE-2024-52759
Published: 2024-11-19
Description: D-LINK DI-8003 v16.07.26A1 was discovered to contain a buffer overflow via the ip parameter in the ip_position_asp function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-120
References: https://github.com/faqiadegege/IoTVuln/blob/main/DI_8003_ip_position_asp_stackoverflow/detail.md; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2018-9348
Published: 2024-11-19
Description: In SMF_ParseMetaEvent of eas_smf.c, there is a possible integer overflow. This could lead to remote denial of service due to resource exhaustion with no additional execution privileges needed. User interaction is needed for exploitation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://source.android.com/security/bulletin/2018-06-01
CVE: CVE-2018-9364
Published: 2024-11-19
Description: In the LG LAF component, there is a special command that allowed modification of certain partitions. This could lead to bypass of secure boot. User interaction is not needed for exploitation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-203
References: https://source.android.com/security/bulletin/2018-06-01
CVE: CVE-2018-9366
Published: 2024-11-19
Description: In IMSA_Recv_Thread and VT_IMCB_Thread of ImsaClient.cpp and VideoTelephony.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-787
References: https://source.android.com/security/bulletin/2018-06-01
CVE: CVE-2018-9367
Published: 2024-11-19
Description: In FT_ACDK_CCT_V2_OP_ISP_SET_TUNING_PARAS of Meta_CCAP_Para.cpp, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://source.android.com/security/bulletin/2018-06-01
CVE: CVE-2018-9368
Published: 2024-11-19
Description: In mtkscoaudio debugfs there is a possible arbitrary kernel memory write due to missing bounds check and weakened SELinux policies. This could lead to local escalation of privilege with system  execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://source.android.com/security/bulletin/2018-06-01
CVE: CVE-2018-9369
Published: 2024-11-19
Description: In bootloader there is fastboot command allowing user specified kernel command line arguments. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
CVSS Score: 7.3 (HIGH)
CWE: CWE-276
References: https://source.android.com/security/bulletin/2018-06-01
CVE: CVE-2018-9370
Published: 2024-11-19
Description: In download.c there is a special mode allowing user to download data into memory and causing possible memory corruptions due to missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
CVSS Score: 7.3 (HIGH)
CWE: CWE-787, CWE-787
References: https://source.android.com/security/bulletin/2018-06-01
CVE: CVE-2018-9371
Published: 2024-11-19
Description: In the Mediatek Preloader, there are out of bounds reads and writes due to an exposed interface that allows arbitrary peripheral memory mapping with insufficient blacklisting/whitelisting. This could lead to local elevation of privilege, given physical access to the device with no additional execution privileges needed. User interaction is needed for exploitation.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-125, CWE-787, CWE-125, CWE-787
References: https://source.android.com/security/bulletin/2018-06-01
CVE: CVE-2018-9372
Published: 2024-11-19
Description: In cmd_flash_mmc_sparse_img of dl_commands.c, there is a possible out of bounds write due to a missing bounds check. This could lead to a local escalation of privilege in the bootloader with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2018-06-01
CVE: CVE-2018-9409
Published: 2024-11-19
Description: In HWCSession::SetColorModeById of hwc_session.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2018-06-01
CVE: CVE-2024-11395
Published: 2024-11-19
Description: Type Confusion in V8 in Google Chrome prior to 131.0.6778.85 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-843
References: https://chromereleases.googleblog.com/2024/11/stable-channel-update-for-desktop_19.html; https://issues.chromium.org/issues/377384894