Dongdong She

**Name of the Vulnerable Software and Affected Versions** IJG JPEG (aka libjpeg) versions prior to 9d **Description** The issue is related to the `jpeg mem available()` function in `jmemnobs.c` in `djpeg`, which does not honor the `max memory to use` setting, possibly causing excessive memory consumption. This could allow a remote attacker to disclose protected information or cause a denial of service. **Recommendations** For versions prior to 9d, update to version 9d or later to resolve the issue. As a temporary workaround, consider restricting the use of the `jpeg mem available()` function in `djpeg` to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** GNU Binutils versions through 2.31 **Description** An issue in the Binary File Descriptor (BFD) library, specifically in the elf.c component, is related to the IS CONTAINED BY LMA macro. This issue causes an integer overflow and an infinite loop. The exploitation of this issue can lead to a denial of service by a remote attacker. **Recommendations** For GNU Binutils versions through 2.31, consider updating to a version that addresses the integer overflow and infinite loop issue caused by the IS CONTAINED BY LMA macro in elf.c. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Huawei Mate8 phones with software NXT-AL10C00B561 and earlier versions Huawei Mate8 phones with software NXT-CL10C00B561 and earlier versions Huawei Mate8 phones with software NXT-DL10C00B561 and earlier versions Huawei Mate8 phones with software NXT-TL10C00B561 and earlier versions **Description** The issue in the ION memory management module allows attackers to cause a denial of service, which can result in the device restarting. **Recommendations** For Huawei Mate8 phones with software NXT-AL10C00B561 and earlier versions, update to a version later than NXT-AL10C00B561. For Huawei Mate8 phones with software NXT-CL10C00B561 and earlier versions, update to a version later than NXT-CL10C00B561. For Huawei Mate8 phones with software NXT-DL10C00B561 and earlier versions, update to a version later than NXT-DL10C00B561. For Huawei Mate8 phones with software NXT-TL10C00B561 and earlier versions, update to a version later than NXT-TL10C00B561.

**Name of the Vulnerable Software and Affected Versions** Huawei P9 phones with software EVA-AL10C00B192 and earlier versions Huawei P9 phones with software EVA-DL10C00B192 and earlier versions Huawei P9 phones with software EVA-TL10C00B192 and earlier versions Huawei P9 phones with software EVA-CL10C00B192 and earlier versions **Description** The issue in the ION memory management module allows attackers to obtain sensitive information from uninitialized memory. **Recommendations** For Huawei P9 phones with software EVA-AL10C00B192 and earlier versions, update to a version later than EVA-AL10C00B192. For Huawei P9 phones with software EVA-DL10C00B192 and earlier versions, update to a version later than EVA-DL10C00B192. For Huawei P9 phones with software EVA-TL10C00B192 and earlier versions, update to a version later than EVA-TL10C00B192. For Huawei P9 phones with software EVA-CL10C00B192 and earlier versions, update to a version later than EVA-CL10C00B192.

**Name of the Vulnerable Software and Affected Versions** Huawei Mate 8 phones with software NXT-AL10C00B197 and earlier versions Huawei Mate 8 phones with software NXT-DL10C00B197 and earlier versions Huawei Mate 8 phones with software NXT-TL10C00B197 and earlier versions Huawei Mate 8 phones with software NXT-CL10C00B197 and earlier versions **Description** The issue affects the ION memory management module, allowing attackers to cause a denial of service, which results in the device restarting. **Recommendations** For Huawei Mate 8 phones with software NXT-AL10C00B197 and earlier versions, update to a version later than NXT-AL10C00B197. For Huawei Mate 8 phones with software NXT-DL10C00B197 and earlier versions, update to a version later than NXT-DL10C00B197. For Huawei Mate 8 phones with software NXT-TL10C00B197 and earlier versions, update to a version later than NXT-TL10C00B197. For Huawei Mate 8 phones with software NXT-CL10C00B197 and earlier versions, update to a version later than NXT-CL10C00B197.

**Name of the Vulnerable Software and Affected Versions** Android versions prior to 2016-10-05 **Description** The issue is related to multiple use-after-free vulnerabilities in the Qualcomm sound driver. These vulnerabilities allow attackers to gain privileges via a crafted application. The estimated number of potentially affected devices is not specified. **Recommendations** For Android versions prior to 2016-10-05, update to a version released after 2016-10-05 to resolve the issue. As a temporary workaround, consider restricting access to the sound driver to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 4.0.3 **Description** The issue allows local users to obtain sensitive information from kernel memory. This is due to the failure to initialize certain data structures in the arch/arm64/mm/dma-mapping.c file, which can be exploited by triggering a dma mmap call. **Recommendations** For Linux kernel versions prior to 4.0.3, update to version 4.0.3 or later to resolve the issue.