Buffer Copy Without Checking Size of Input in Video
Memory corruption while processing manipulated payload in video firmware.
Memory corruption while processing manipulated payload in video firmware.
Transient DOS when importing a PKCS#8-encoded RSA private key with a zero-sized modulus.
Memory corruption while processing multiple simultaneous escape calls.
Memory corruption while processing event close when client process terminates abruptly.
Weak Configuration due to improper input validation in Modem while processing LTE security mode command message received from network.
Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame.
Transient DOS while processing TIM IE from beacon frame as there is no check for IE length.
Memory corruption during the handshake between the Primary Virtual Machine and Trusted Virtual Machine.
Transient DOS while parsing the multi-link element Control field when common information length check is missing before updating the location.
Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to address in the middle of ring element.
Memory corruption while invoking IOCTLs calls from user space for internal mem MAP and internal mem UNMAP.
Memory corruption in video while parsing the Videoinfo, when the size of atom is greater than the videoinfo size.
Memory corruption when multiple listeners are being registered with the same file descriptor.
Information disclosure while parsing dts header atom in Video.
Memory corruption while passing untrusted/corrupted pointers from DSP to EVA.
Transient DOS while parsing the received TID-to-link mapping element of beacon/probe response frame.
Memory corruption when user provides data for FM HCI command control operations.
Information disclosure when the ADSP payload size received in HLOS in response to Audio Stream Manager matrix session is less than this expected size.
Transient DOS while processing IKEv2 Informational request messages, when a malformed fragment packet is received.