Product name Confidentiality level

JKM-LX1 CONFIDENTIAL
Commercial Name
Total 12 pages
HUAWEI Y9 2019

XXX Software Release Notes Vx.y

Prepared by JKM Team Date 2018-09-04

Reviewed by JKM Team Date 2018-09-04
Approved by JKM Team Date 2018-09-04

Huawei Technologies Co., Ltd.

All rights reserved

 Revision Record
Date Revision Change Description Author
version

1. Change “Product version” to “Commercial Name”

2. Remove “Main features”
3. Make “Version Description” more clear
2018-2-13 2.1 4.Change” Improvement in the Previous Version” to
MR TEAM
“Improvement From the Previous Version”
4.Change “Effect” to “Remarks”
 Table of Contents
1 Version Description..................................................................................................................4
2 New Features..........................................................................................................................4
3 Improvement From the Previous Version................................................................................4
4 Known Limitations and Issues.................................................................................................5
5 Software Vulnerabilities Fixes..................................................................................................5
 XXX Software Release Notes CONFIDENTIAL

Vx.y
XXX Software Release Notes Vx.y

1 Version Description

Current version JKM-LX1 8.2.0.102(C185)

Previous version JKM-LX1 8.2.0.7(C185)

OS version Android 8.1

EMUI version EMUI8.2

CPU KIRIN 710

Baseband version
Kernel Version 4.4.103+

Version Type TA

2 New Features
Index Case ID Issue Description

1 AR000AN1CR CITC certification logo

2 AR000B60E4 Cloud service update

3 AR000B83VI Ghana MTN UT parameter update

3 Improvement From the Previous Version

Index Case ID
1 DTS2018070300419
2 DTS2018081403160
3 DTS2018072708337
4 DTS2018080209410
Issue Description
【Setting_ Long Screenshot 】Open the Phoenix News
website, Long Screenshot can’t capture complete
images
None Setting attributes of ro.product.first_api_level
【 Protocol _volte 】 【 hw_meafnaf 】 The UI of some
subnets is inconsistent with the baseline.
【Globalization _10/10】In Arabic, enter the HW health
platform firstly, the language in prompt interface is not
Arabic
Page 4
 XXX Software Release Notes CONFIDENTIAL

Index Case ID Vx.y Issue Description

4 Known Limitations and Issues

Index Issue Description Effect
【APR】【JKM-LX1_JKM-LX1
1 8.2.0.8(C185log)_Crash_MONKEY_log】performLa Suggestion
unchActivity
2 Tips is blank In Arabic and Persian Minor
Connect the to the Wi-Fi network with card and
match the online theme, the system displays a
3 Minor
message indicating that the theme application stops
runnin after setting the font style,

5 Software Vulnerabilities Fixes

[Software Vulnerabilities include Android Vulnerability, Third-party software Vulnerability, and Huawei
Vulnerability]

[Android Vulnerability is from Google, which reported publicly.]

[Third-party software is a type of computer software that is sold together with or provided for free in Huawei
products or solutions with the ownership of intellectual property rights (IPR) held by the original contributors.
Third-party software can be but is not limited to: Purchased software, Software that is built in or attached to
purchased hardware, Software in products of the original equipment manufacturer (OEM) or original design
manufacturer (ODM), Software that is developed with technical contribution from partners (ownership of IPR
all or partially held by the partners), Software that is legally obtained free of charge.
The data of third-party software vulnerabilities fixes can be exported from PDM.
If the table is excessively long, you can divide it into multiple ones by product version, or deliver it in an excel
file with patch release notes and provide reference information in this section.]

[Huawei Vulnerability is Huawei own software’ Vulnerability, which found by outside]

Vulnerabilities information is available through CVE IDs in NVD (National Vulnerability Database) website:
http://web.nvd.nist.gov/view/vuln/search

Software/Module Version CVE Vulnerability Description Impact

name ID Description

Platform 8.0,8.1,9.0 CVE- In bta_hd_get_report_act of The fix is

2018- bta_hd_act.cc, there is a possible designed
9480 out-of-bounds read due to perform
improper input validation. This validation to
Page 5
 XXX Software Release Notes CONFIDENTIAL

Vx.y could lead to remote information

disclosure in the Bluetooth
prevent
integer
service with no additional underflow.
execution privileges needed.
User interaction is not needed
for exploitation.
Platform 8.0,8.1,9.0 CVE- In bta_hd_set_report_act of The fix is
2018- bta_hd_act.cc, there is a possible designed
9481 out-of-bounds read due to an perform
integer overflow. This could lead validation to
to remote information disclosure prevent
in the Bluetooth service with no integer
additional execution privileges underflow.
needed. User interaction is not
needed for exploitation.
Platform 8.0,8.1,9.0 CVE- In intr_data_copy_cb of The fix is
2018- btif_hd.cc, there is a possible out designed to
9482 of bounds read due to an integer perform
overflow. This could lead to local validation to
information disclosure in the prevent
Bluetooth service with no integer
additional execution privileges underflow.
needed. User interaction is not
needed for exploitation.
Platform 7.1.1,7.1.2,8.0,8.1,9.0 CVE- In multiple functions of The fix is
2018- ShortcutService.java, there is a designed to
9469 possible creation of a spoofed verify
shortcut due to a missing shortcut info.
permission check. This could lead
to local escalation of privilege in
a privileged app with no
additional execution privileges
needed. User interaction is
needed for exploitation.
Platform 8.0,8.1,9.0 CVE- In the SELinux permissions of The fix is
2018- crash_dump.te, there is a designed to
9488 permissions bypass due to a disallow
missing restriction.  This could ptrace of TCB
lead to a local escalation of components.
privilege, with System privileges
needed.  User interaction is not
needed for exploitation.
Platform 7.0,7.1.1,7.1.2,8.0,8.1,9.0 CVE- In The fix is
2018- bta_dm_remove_sec_dev_entry designed to
9483 of bta_dm_act.cc, there is a save a copy
possible out of bounds read due and
to a use after free. This could rearrange
lead to remote information the code to
disclosure over bluetooth with prevent the
no additional execution privileges use after
needed. User interaction is not free.
needed for exploitation.
Platform 7.0,7.1.1,7.1.2,8.0,8.1,9.0 CVE- In the getHost() function of The fix is
2018- UriTest.java, there is the designed to
9467 possibility of incorrect web origin fix the
determination. This could lead to hostname
Page 6
 XXX Software Release Notes CONFIDENTIAL

Vx.y incorrect security decisions with

no additional execution privileges
parsing.

needed. User interaction is not

needed for exploitation.
Platform 7.0,7.1.1,7.1.2,8.0,8.1,9.0 CVE- In query of The fix is
2018- DownloadManager.java, there is designed to
9468 a possible read/write of arbitrary remove the
files due to a permissions bypass. public
This could lead to local download
information disclosure and file feature.
rewriting with no additional
execution privileges needed.
User interaction is not needed
for exploitation.
Platform 7.0,7.1.1,7.1.2,8.0,8.1 CVE- In the The fix is
2018- xmlSnprintfElementContent designed to
9466 function of valid.c, there is a update libxml
possible out of bounds write. to version
This could lead to remote 2.9.8.
escalation of privilege in an
unprivileged app with no
additional execution privileges
needed. User interaction is
needed for exploitation.
Platform 7.0,7.1.1,7.1.2,8.0,8.1,9.0 CVE- In libstagefright code that The fix is
2018- handles ringtone related designed to
9347 processing, there is an infinite prevent the
loop. ?This could lead to remote infinite loop.
temporary denial of service with
no additional execution privileges
needed. ?User interaction is not
needed for exploitation.
Kernel NA CVE- In user and kernel memory, there The fix is
2017- is a possible out of bounds read designed to
5754 due to speculation attacks.  This unmap the
could lead to local information kernel when
disclosure with no additional running in
execution privileges needed. userspace.
User interaction is not needed
for exploitation.
Platform 8.0,8.1,9.0 CVE- In setVpnForcedLocked of The fix is
2018- Vpn.java, there is a possible designed to
9487 blocking of internet traffic fix the uid
through vpn due to a bad uid check to
check. This could lead to local allow for
denial of service with no traffic to flow
additional execution privileges through a
needed. User interaction is VPN.
needed for exploitation.
Platform 8.0,8.1,9.0 CVE- In CopyToOMX of The fix is
2018- OMXNodeInstance.cpp there is a designed to
9427 possible out-of-bounds write due avoid the
to an incorrect bounds check. out-of-
This could lead to remote bounds
arbitrary code execution with no write.
additional execution privileges
Page 7
 XXX Software Release Notes CONFIDENTIAL

Vx.y needed. User interaction is

needed for exploitation.
Platform 7.0,7.1.1,7.1.2,8.0,8.1,9.0 CVE- In the deserialization constructor The fix is
2018- of NanoAppFilter.java, there is a designed to
9471 possible loss of data due to type resolve the
confusion. This could lead to inconsistent
local escalation of privilege in the Parcel read.
system server with no additional
execution privileges needed.
User interaction is not needed
for exploitation.
Platform 7.0,7.1.1,7.1.2,8.0,8.1,9.0 CVE- In writeToParcel of The fix is
2018- MediaPlayer.java, there is a designed to
9474 possible fix the
serialization/deserialization serialization.
mismatch due to improper input
validation. This could lead to
local escalation of privilege with
no additional execution privileges
needed. User interaction is not
needed for exploitation.
Platform 7.0,7.1.1,7.1.2,8.0,8.1,9.0 CVE- In parse of M3UParser.cpp there The fix is
2018- is a possible resource exhaustion designed to
9440 due to improper input validation. avoid
This could lead to denial of resource
service with no additional exhaustion.
execution privileges needed.
User interaction is needed for
exploitation.
Platform 7.0,7.1.1,7.1.2,8.0,8.1 CVE- In sdpu_extract_attr_seq of The fix is
2018- sdp_utils.cc, there is a possible designed to
9456 out of bounds read due to an recalculate
incorrect bounds check. This param_len
could lead to remote denial of when
service with no additional necessary.
execution privileges needed.
User interaction is not needed
for exploitation.
Platform 7.0,7.1.1,7.1.2,8.0,8.1,9.0 CVE- In bff_Scanner_addOutPos of The fix is
2018- Scanner.c, there is a possible out- designed to
9470 of-bounds write due to an make the
incorrect bounds check. This correct
could lead to remote escalation bounds
of privilege in an unprivileged check.
app with no additional execution
privileges needed. User
interaction is needed for
exploitation.
Platform 7.0,7.1.1,7.1.2,8.0,8.1,9.0 CVE- In process_service_attr_req and The fix is
2018- process_service_search_attr_req designed to
9478 of sdp_server.cc, there is an out return an
of bounds write due to a missing error when
bounds check. This could lead to an offset is
remote code execution with no too large.
additional execution privileges
needed.  User interaction is not
Page 8
 XXX Software Release Notes CONFIDENTIAL

Platform
Vx.y
7.0,7.1.1,7.1.2,8.0,8.1,9.0
CVE-
needed for exploitation.
In process_service_attr_req and The fix is
2018- process_service_search_attr_req designed to
9479 of sdp_server.cc, there is an out return an
of bounds write due to a missing error when
bounds check. This could lead to an offset is
remote code execution with no too large.
additional execution privileges
needed.  User interaction is not
needed for exploitation.
Platform 7.0,7.1.1,7.1.2,8.0,8.1,9.0 CVE- In The fix is
2018- HeadsetInterface::ClccResponse designed to
9475 of btif_hf.cc, there is a possible appropriately
out of bounds stack write due to limit data
a missing bounds check. This written to
could lead to remote escalation arrays.
of privilege via Bluetooth, if the
recipient has enabled SIP calls
with no additional execution
privileges needed. User
interaction is not needed for
exploitation.
Platform 8.0,8.1,9.0 CVE- In decrypt of The fix is
2018- ClearKeyCasPlugin.cpp there is a designed to
9411 possible out-of-bounds write due avoid the
to a missing bounds check. This out-of-
could lead to remote arbitrary bounds
code execution with no write.
additional execution privileges
needed. User interaction is
needed for exploitation.
Platform 7.0,7.1.1,7.1.2,8.0,8.1,9.0 CVE- In l2cu_send_peer_config_rej of The fix is
2018- l2c_utils.cc, there is a possible designed to
9484 out of bounds read due to a add a bounds
missing bounds check. This could check.
lead to remote information
disclosure with no additional
execution privileges needed.
User interaction is not needed
for exploitation.
Platform 7.0,7.1.1,7.1.2,8.0,8.1 CVE- In xmlMemStrdupLoc of The fix is
2018- xmlmemory.c, there is a possible designed to
9472 out-of-bounds write due to an update
integer overflow. This could lead libxml2 to
to remote code execution in an 2.9.8.
unprivileged process with no
additional execution privileges
needed. User interaction is
needed for exploitation.
Platform 7.0,7.1.1,7.1.2,8.0,8.1,9.0 CVE- In l2cble_process_sig_cmd of The fix is
2018- l2c_ble.cc, there is a possible out designed to
9485 of bounds read due to a missing add bounds
bounds check. This could lead to checks.
remote information disclosure
over bluetooth with no
additional execution privileges
Page 9
 XXX Software Release Notes CONFIDENTIAL

Vx.y needed. User interaction is not

needed for exploitation.
Platform 7.0,7.1.1,7.1.2,8.0,8.1,9.0 CVE- In hidh_l2cif_data_ind of The fix is
2018- hidh_conn.cc, there is a possible designed to
9486 out of bounds read due to a add a bounds
missing bounds check. This could check.
lead to local information
disclosure over bluetooth with
no additional execution privileges
needed. User interaction is not
needed for exploitation.
Platform 8.0,8.1 CVE- In the development options The fix is
2018- section of the Settings app, there designed to
9477 is a possible authentication delete an
bypass due to a missing obsolete
permission check. This could lead activity alias.
to local escalation of privilege
with no additional execution
privileges needed. User
interaction is needed for
exploitation.
Kernel NA CVE- Android phones do not listen for This advisory
2018- traffic from open-internet facing will be
5391 TCP ports by default and a device updated with
reboot can remediate these technical
issues. We are unaware of any details as
successful reproduction of these part of a
vulnerabilities on Android coordinated
phones operating in a default disclosure
configuration. Devices with open process.
TCP listening ports and fixed IP
addresses are at increased risk.
Kernel NA CVE- Android phones do not listen for This advisory
2018- traffic from open-internet facing will be
5390 TCP ports by default and a device updated with
reboot can remediate these technical
issues. We are unaware of any details as
successful reproduction of these part of a
vulnerabilities on Android coordinated
phones operating in a default disclosure
configuration. Devices with open process.
TCP listening ports and fixed IP
addresses are at increased risk.

Page 10