Information disclosure while processing IO control commands.
Memory corruption while configuring a Hypervisor based input virtual device.
Memory corruption in TZ Secure OS while Tunnel Invoke Manager initialization.
Memory corruption when the bandpass filter order received from AHAL is not within the expected range.
Memory corruption due to double free in Core while mapping HLOS address to the list.
Memory Corruption in GPU Subsystem due to arbitrary command execution from GPU in privileged mode.
Memory corruption while invoking IOCTL calls from user space to issue factory test command inside WLAN driver.
Memory corruption while Configuring the SMR/S2CR register in Bypass mode.
Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon.
Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length.
Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero.
Transient DOS while parsing fragments of MBSSID IE from beacon frame.
Transient DOS while decoding attach reject message received by UE, when IEI is set to ESM_IEI.
Memory corruption when IOMMU unmap operation fails, the DMA and anon buffers are getting released.
Memory corruption when allocating and accessing an entry in an SMEM partition.
Memory corruption when an invoke call and a TEE call are bound for the same trusted application.
Memory corruption while processing key blob passed by the user.