Integer Overflow to Buffer Overflow in Automotive
Memory corruption in Automotive due to integer overflow to buffer overflow while registering a new listener with shared buffer.
Memory corruption in Automotive due to integer overflow to buffer overflow while registering a new listener with shared buffer.
Memory corruption in Automotive due to improper input validation.
Memory corruption in kernel due to missing checks when updating the access rights of a memextent mapping.
Memory corruption in display due to double free while allocating frame buffer memory
Memory corruption in display driver due to incorrect type casting while accessing the fence structure fields
Memory corruption in Bluetooth HOST due to buffer overflow while parsing the command response received from remote
Memory corruption in core due to stack-based buffer overflow
Memory corruption in Core due to stack-based buffer overflow.
Memory corruption in Automotive Android OS due to improper input validation.
Transient DOS due to buffer over-read in WLAN while processing 802.11 management frames.
Transient DOS due to buffer over-read in WLAN while parsing WLAN CSA action frames.
Information disclosure due to buffer over-read in Bluetooth HOST while processing GetFolderItems and GetItemAttribute Cmds from peer device.
Memory corruption during voice activation, when sound model parameters are loaded from HLOS to ADSP.
Memory corruption during voice activation, when sound model parameters are loaded from HLOS, and the received sound model list is empty in HLOS drive.
Memory corruption can occur if an already verified IFS2 image is overwritten, bypassing boot verification. This allows unauthorized programs to be injected into security-sensitive images, enabling the booting of a tampered IFS2 system image.
Memory corruption due to improper validation of array index in WLAN HAL when received lm_itemNum is out of range.
Memory corruption in Core Platform while printing the response buffer in log.
Memory Corruption in Core Platform while printing the response buffer in log.