| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Transient DOS while processing multiple payload container type with incorrect container length received in DL NAS transport OTA in NR. |
| Transient DOS while processing DL NAS Transport message, as specified in 3GPP 24.501 v16. |
| Transient DOS while processing PDU Release command with a parameter PDU ID out of range. |
| Information disclosure when VI calibration state set by ADSP is greater than MAX_FBSP_STATE in the response payload to AFE calibration command. |
| Memory corruption when resource manager sends the host kernel a reply message with multiple fragments. |
| Memory corruption during management frame processing due to mismatch in T2LM info element. |
| Memory corruption while playing audio file having large-sized input buffer. |
| Memory corruption when preparing a shared memory notification for a memparcel in Resource Manager. |
| Transient DOS when importing a PKCS#8-encoded RSA private key with a zero-sized modulus. |
| Memory corruption while processing manipulated payload in video firmware. |
| Memory corruption when input parameter validation for number of fences is missing for fence frame IOCTL calls, |
| Memory corruption when BTFM client sends new messages over Slimbus to ADSP. |
| Weak Configuration due to improper input validation in Modem while processing LTE security mode command message received from network. |
| Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame. |
| Transient DOS while processing TIM IE from beacon frame as there is no check for IE length. |
| Memory corruption during the handshake between the Primary Virtual Machine and Trusted Virtual Machine. |
| Transient DOS while parsing the multi-link element Control field when common information length check is missing before updating the location. |
| Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to address in the middle of ring element. |
| Memory corruption while invoking IOCTLs calls from user space for internal mem MAP and internal mem UNMAP. |
| Memory corruption in video while parsing the Videoinfo, when the size of atom is greater than the videoinfo size. |
