Security Bulletin

Summary
  • Security CVES
  • High CVE-2022-47335,CVE-2022-47336,CVE-2022-47337,CVE-2022-47338
  • Medium CVE-2022-47362,CVE-2022-47463,CVE-2022-47464,CVE-2022-47465,CVE-2022-47466,CVE-2022-47467,CVE-2022-47468
Minutia
  • CVE ID CVE-2022-47335
  • Title Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in Telecom service
  • Description

    In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.

  • Technology Area Android
  • Vulnerability Type CWE-120 Buffer Copy without Checking Size of Input
  • Access Vector Local
  • CVSS Rating High
  • CVSS Score 8.2
  • CVSS String CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
  • Affected Chipsets*

    SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000

  • CVE ID CVE-2022-47336
  • Title Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in Telecom service
  • Description

    In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.

  • Technology Area Android
  • Vulnerability Type CWE-120 Buffer Copy without Checking Size of Input
  • Access Vector Local
  • CVSS Rating High
  • CVSS Score 8.2
  • CVSS String CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
  • Affected Chipsets*

    SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000

  • CVE ID CVE-2022-47337
  • Title Out-of-bounds Write in Media service
  • Description

    In media service, there is a missing permission check. This could lead to local denial of service in media service.

  • Technology Area Android
  • Vulnerability Type CWE-787 Out-of-bounds Write
  • Access Vector Local
  • CVSS Rating High
  • CVSS Score 7.3
  • CVSS String CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:L
  • Affected Chipsets*

    SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000

  • CVE ID CVE-2022-47338
  • Title Exposure of Sensitive Information to an Unauthorized Actor in email service
  • Description

    In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.

  • Technology Area Android
  • Vulnerability Type CWE-200 Exposure of Sensitive Information to an Unauthorized Act
  • Access Vector Local
  • CVSS Rating High
  • CVSS Score 7.3
  • CVSS String CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
  • Affected Chipsets*

    SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000

  • CVE ID CVE-2022-47362
  • Title Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in Telecom service
  • Description

    In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.

  • Technology Area Android
  • Vulnerability Type CWE-120 Buffer Copy without Checking Size of Input
  • Access Vector Local
  • CVSS Rating Medium
  • CVSS Score 4.2
  • CVSS String CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
  • Affected Chipsets*

    SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000

  • CVE ID CVE-2022-47463
  • Title Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in in Vdsp service
  • Description

    In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.

  • Technology Area Android
  • Vulnerability Type CWE-120 Buffer Copy without Checking Size of Input
  • Access Vector Local
  • CVSS Rating Medium
  • CVSS Score 4.4
  • CVSS String CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
  • Affected Chipsets*

    SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000

  • CVE ID CVE-2022-47464
  • Title Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in in Vdsp service
  • Description

    In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.

  • Technology Area Android
  • Vulnerability Type CWE-120 Buffer Copy without Checking Size of Input
  • Access Vector Local
  • CVSS Rating Medium
  • CVSS Score 4.4
  • CVSS String CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
  • Affected Chipsets*

    SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000

  • CVE ID CVE-2022-47465
  • Title NULL Pointer Dereference in Vdsp service
  • Description

    In vdsp service, there is a missing permission check. This could lead to local denial of service in vdsp service.

  • Technology Area Android
  • Vulnerability Type CWE-476 NULL Pointer Dereference
  • Access Vector Local
  • CVSS Rating Medium
  • CVSS Score 4.4
  • CVSS String CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
  • Affected Chipsets*

    SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000

  • CVE ID CVE-2022-47466
  • Title NULL Pointer Dereference in Telecom service
  • Description

    In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.

  • Technology Area Android
  • Vulnerability Type CWE-476 NULL Pointer Dereference
  • Access Vector Local
  • CVSS Rating Medium
  • CVSS Score 4.4
  • CVSS String CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
  • Affected Chipsets*

    SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000

  • CVE ID CVE-2022-47467
  • Title NULL Pointer Dereference in Telecom service
  • Description

    In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.

  • Technology Area Android
  • Vulnerability Type CWE-476 NULL Pointer Dereference
  • Access Vector Local
  • CVSS Rating Medium
  • CVSS Score 4.4
  • CVSS String CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
  • Affected Chipsets*

    SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000

  • CVE ID CVE-2022-47468
  • Title NULL Pointer Dereference in Telecom service
  • Description

    In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.

  • Technology Area Android
  • Vulnerability Type CWE-476 NULL Pointer Dereference
  • Access Vector Local
  • CVSS Rating Medium
  • CVSS Score 4.4
  • CVSS String CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
  • Affected Chipsets*

    SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000

*The list of affected chipsets may not be complete. For latest information, device OEMs can contact directly at https://unisupport.unisoc.com

Vulnerability type definition
  • Abbreviation Interpretation
  • RCE Remote Code Execution
  • EoP Elevation of Privilege
  • ID Information Disclosure
  • DoS Denial of Service
  • N/A Classification not available
Version
  • Version Date Description
  • 1.0 2023-04-11