Qualcomm Security Bulletin: Video/Kernel/Audio Vulnerabilities (CVE-2019-10590, etc.)

Key Information Summary Vulnerability Overview Release Date: February 3, 2020 Version: 1.0 Main Content: This security bulletin aims to assist Qualcomm Technologies' customers in performing security updates for devices that are released or即将 released, covering resolved security vulnerabilities in Qualcomm proprietary code and links to related code, as well as vulnerabilities in Linux base software. Vulnerability List Vulnerability Details CVE-2019-10590: - Title: Improper Array Index Validation in Video - Description: Out-of-bounds access occurs when processing dts atom due to invalid standard. - Affected Scope: Video technology area - Access Vector: Remote - Affected Chips: - APQ8009, APQ8017, APQ8053, APQ8064, APQ8096AU, APQ8098, etc. CVE-2019-14051: - Title: Integer Overflow Leading to Buffer Overflow During Kernel Module Loading - Description: Accumulation operations during memory allocation while loading modules can cause integer overflow, ultimately resulting in buffer overflow. - Affected Scope: Kernel technology area - Access Vector: Local - Affected Chips: - MDM9206, MDM9607 CVE-2019-14057: - Title: Buffer Copy Without Input Size Check When Parsing MKV Files in Video - Description: Buffer overflow occurs during decoding of private data due to lack of buffer size check before reading. - Affected Scope: Video technology area - Access Vector: Remote - Affected Chips: - APQ8009, APQ8017, APQ8053, APQ8064, APQ8096AU, etc. Additional Information Security ratings are categorized from low to medium-low severity. Includes detailed list of affected chips and paths to repair patches. Researcher Acknowledgments Lists researchers who reported issues along with descriptions of their contributions, including detailed email addresses and specific issues reported.

Goal Reached Thanks to every supporter — we hit 100%!

Qualcomm Security Bulletin: Video/Kernel/Audio Vulnerabilities (CVE-2019-10590, etc.)