Oliver Chang

The issue is related to a vulnerability in the kernel mode layer handler for specific DxgDdiEscape IDs. A value passed from a user to the driver is used without validation as the index to an internal array, which can lead to denial of service or potential escalation of privileges. The affected IDs are 0x600000E, 0x600000F, and 0x6000010.

The issue concerns a vulnerability in the kernel mode layer handler for DxgDdiEscape ID 0x10000e9, where a value passed from a user to the driver is used without validation as the size input to `memcpy()`, causing a stack buffer overflow. This can lead to denial of service or potential escalation of privileges.

The issue concerns a vulnerability in the kernel mode layer handler for DxgDdiEscape ID 0x7000014, where a value passed from a user to the driver is used without validation as the index to an internal array. This can lead to denial of service or potential escalation of privileges.

The issue concerns a vulnerability in the kernel mode layer handler for DxgDdiEscape ID 0x5000027, where a pointer passed from a user to the driver is used without validation. This can lead to denial of service or potential escalation of privileges.

The issue is related to a vulnerability in the kernel mode layer handler for DxgDdiEscape ID 0x70001b2, where the size of an input buffer is not validated. This can lead to denial of service or potential escalation of privileges.

The issue concerns a vulnerability in the kernel mode layer handler for DxgDdiEscape ID 0x100009a, where a value passed from a user to the driver is used without validation as the index to an internal array. This can lead to denial of service or potential escalation of privileges.

The issue is related to a vulnerability in the kernel mode layer handler for DxgDdiEscape ID 0x7000170, where the size of an input buffer is not validated. This can lead to denial of service or potential escalation of privileges.

The issue is related to a stack buffer overflow in the kernel mode layer, specifically in the nvstreamkms.sys module. This can be triggered by a user with specially crafted executable paths, potentially leading to a denial of service or escalation of privileges.

The issue allows remote attackers to cause a denial of service, potentially leading to a device hang or reboot, via a crafted media file.

The issue concerns a vulnerability in the kernel mode layer handler for DxgDdiEscape ID 0x70000d5, where a value passed from a user to the driver is used without validation as the index to an internal array. This can lead to denial of service or potential escalation of privileges.

The issue is related to insufficient input validation in the Qualcomm hardware video codec. This can be exploited by a remote attacker to cause a denial of service, resulting in a device reboot, by using a specially crafted file. No information is provided about the estimated number of potentially affected devices or real-world incidents.

The issue is caused by multiple integer overflows in the `sycc422 to rgb` and `sycc444 to rgb` functions in PDFium, as used in Google Chrome and Opera. Exploitation of these overflows may allow a remote attacker to cause a denial of service (out-of-bounds read) or possibly have other unspecified impacts via a specially crafted PDF document.

The issue is caused by a buffer overflow in the mediaserver component of the Android operating system. Exploitation of this issue may allow a remote attacker to execute arbitrary code or cause a denial of service (memory corruption) using a specially crafted media file.

The issue is caused by a buffer overflow in the mediaserver component of the Android operating system. Exploitation of this issue may allow a remote attacker to execute arbitrary code or cause a denial of service (memory corruption) by using a specially crafted media file.