Qualcomm Components Multiple Security Vulnerabilities

Bugtraq ID:	108555
Class:	Unknown
CVE:	CVE-2019-2269 CVE-2019-2287 CVE-2019-2260 CVE-2019-2292
Remote:	Yes
Local:	No
Published:	Jun 03 2019 12:00AM
Updated:	Jun 03 2019 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	Google Pixel XL 0 Google Pixel C 0 Google Pixel 0 Google Nexus Player 0 Google Nexus 9 Google Nexus 6P Google Nexus 6 Google Nexus 5X Google Android 0
Not Vulnerable:

Qualcomm Components Multiple Security Vulnerabilities

Qualcomm Components are prone to the following security vulnerabilities:

1. Multiple buffer-overflow vulnerabilities
2. A denial-of-service vulnerability

An attacker can exploit these issues to execute arbitrary code, and cause a denial-of-service condition. This may aid in further attacks.

These issues are being tracked by Android Bug IDs A-123700924, A-114399807, A-123999895, and A-127513046.

Qualcomm Components Multiple Security Vulnerabilities

References:

• Android Homepage (Google)
  
• msm: vidc: ensure codec count is in supported session range (CodeAurora)
  
• perf: core: Avoid race condition when releasing perf-events (CodeAurora)
  
• qcacld-3.0: Add bound check for fixed_param->total_num_tx_power_levels (CodeAurora)
  
• qcacld-3.0: Fix possible buffer overflow in sir_convert_addts_rsp2_struct (CodeAurora)
  
• Qualcomm Homepage (Qualcomm)
  
• Android Security Bulletin�??June 2019 (Android)