Reachable assertion in Modem
Transient DOS due to reachable assertion in Modem while processing SIB1 Message.
Transient DOS due to reachable assertion in Modem while processing SIB1 Message.
Transient DOS due to reachable assertion in Modem because of invalid network configuration.
Transient DOS due to reachable assertion in modem when network repeatedly sent invalid message container for NR to LTE handover.
Memory corruption in User Identity Module due to integer overflow to buffer overflow when a segement is received via qmi http.
Memory corruption in Audio due to use of out-of-range pointer offset while Initiating a voice call session from user space with invalid session id.
Transient DOS due to reachable assertion in modem during MIB reception and SIB timeout
Memory corruption due to improper access control in Qualcomm IPC.
Memory corruption due to improper authentication in Qualcomm IPC while loading unsigned lib in audio PD.
Memory corruption in Audio due to incorrect type cast during audio use-cases.
Memory corruption due to configuration weakness in modem wile sending command to write protected files.
Memory corruption due to buffer copy without checking size of input while running memory sharing tests with large scattered memory.
Memory corruption due to double free in core while initializing the encryption key.
Memory corruption in FM Host due to buffer copy without checking the size of input in FM Host
Information disclosure due to buffer over-read in Modem while using static array to process IPv4 packets.
Information disclosure sue to buffer over-read in modem while processing ipv6 packet with hop-by-hop or destination option in header.
Memory corruption in Linux android due to double free while calling unregister provider after register call.
Memory corruption due to buffer copy without checking the size of input in Core while processing ioctl commands from diag client applications.
Memory corruption due to use after free in trusted application environment.
Memory corruption in core due to buffer copy without check9ing the size of input while processing ioctl queries.