Memory corruption in BTHOST due to double free while music playback and calls over bluetooth headset in Snapdragon Mobile

Buffer Over-read in Multi-Mode Call Processor

Memory corruption while decoding of OTA messages from T3448 IE.

Buffer Over-read in Multi-Mode Call Processor

Transient DOS while processing of a registration acceptance OTA due to incorrect ciphering key data IE.

Integer Overflow or Wraparound in BT Controller

Transient DOS can occur while processing UCI command.

Improper Access Control in Core

Memory Corruption in Core while invoking a call to Access Control core library with hardware protected address range.

Improper Input Validation in HLOS

Memory Corruption in HLOS while registering for key provisioning notify.

Improper Authentication in Data Modem

Cryptographic issue in Data Modem due to improper authentication during TLS handshake.

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera

Memory corruption while taking a snapshot with hardware encoder due to unvalidated userspace buffer.

Use After Free in Windows WLAN Host

Memory corruption while handling IOCTL call from user-space to set latency level.

Use After Free in WLAN Host Communication

Memory corruption may occour occur when stopping the WLAN interface after processing a WMI command from the interface.

Use of Out-of-range Pointer Offset in Display

Memory corruption may occour while generating test pattern due to negative indexing of display ID.

Buffer Over-read in WLAN HOST

Information disclosure while parsing the OCI IE with invalid length.

Use of Out-of-range Pointer Offset in WLAN Windows Host

Memory corruption while Invoking IOCTL calls from user-space to validate FIPS encryption or decryption functionality.

Improper Validation of Array Index in Graphics_Linux

Memory corruption while processing IOCTL from user space to handle GPU AHB bus error.

Improper Validation of Array Index in Camera

Memory corruption while power-up or power-down sequence of the camera sensor.

Improper Validation of Array Index in Camera Driver

Memory corruption while validating number of devices in Camera kernel .

Untrusted Pointer Dereference in Automotive Android OS

Memory corruption can occur when a compat IOCTL call is followed by a normal IOCTL call from userspace.

Improper Validation of Array Index in Camera

Memory corruption in Camera due to unusually high number of nodes passed to AXI port.

Improper Validation of Array Index in Camera

Memory corruption can occur in the camera when an invalid CID is used.

Buffer Over-read in Multi Mode Call Processor

Transient DOS when registration accept OTA is received with incorrect ciphering key data IE in modem.