Summary

Security CVES
Medium CVE-2024-39440,CVE-2024-39439,CVE-2024-39438,CVE-2024-39437,CVE-2024-39436

Minutia

CVE ID CVE-2024-39440
Title NULL Pointer Dereference in DRM service
Description
In DRM service, there is a possible system crash due to null pointer dereference. This could lead to local denial of service with System execution privileges needed.
Technology Area Android
Vulnerability Type CWE-476 NULL Pointer Dereference
Access Vector Local
CVSS Rating Medium
CVSS Score 6.2
CVSS String CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Chipsets*
T606/T612/T616/T610/T618/T760/T770/T820/S8000

CVE ID CVE-2024-39439
Title Out-of-bounds Write in DRM service
Description
In DRM service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
Technology Area Android
Vulnerability Type CWE-787 Out-of-bounds Write
Access Vector Local
CVSS Rating Medium
CVSS Score 6.2
CVSS String CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Chipsets*
T606/T612/T616/T610/T618/T760/T770/T820/S8000

CVE ID CVE-2024-39438
Title Improper Neutralization of Special Elements used in a Command ('Command Injection') in linkturbonative service
Description
In linkturbonative service, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed.
Technology Area Android
Vulnerability Type CWE-77 Command Injection
Access Vector Local
CVSS Rating Medium
CVSS Score 6.5
CVSS String CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Affected Chipsets*
SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000

CVE ID CVE-2024-39437
Title Improper Neutralization of Special Elements used in a Command ('Command Injection') in linkturbonative service
Description
In linkturbonative service, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed.
Technology Area Android
Vulnerability Type CWE-77 Command Injection
Access Vector Local
CVSS Rating Medium
CVSS Score 6.5
CVSS String CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Affected Chipsets*
SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000

CVE ID CVE-2024-39436
Title Improper Neutralization of Special Elements used in a Command ('Command Injection') in linkturbonative service
Description
In linkturbonative service, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed.
Technology Area Android
Vulnerability Type CWE-77 Command Injection
Access Vector Local
CVSS Rating Medium
CVSS Score 6.5
CVSS String CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Affected Chipsets*
SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000

*The list of affected chipsets may not be complete. For latest information, device OEMs can contact directly at https://unisupport.unisoc.com

Vulnerability type definition

Version