Integer Overflow to Buffer Overflow in Bluetooth HOST
Memory corruption in Bluetooth HOST due to buffer overflow while parsing the command response received from remote
Memory corruption in Bluetooth HOST due to buffer overflow while parsing the command response received from remote
Memory corruption in core due to stack-based buffer overflow
Memory corruption in Core due to stack-based buffer overflow.
Memory corruption in Automotive Android OS due to improper input validation.
Transient DOS due to buffer over-read in WLAN while processing 802.11 management frames.
Transient DOS due to buffer over-read in WLAN while parsing WLAN CSA action frames.
Information disclosure due to buffer over-read in WLAN while parsing BTM action frame.
Information disclosure due to buffer over-read in WLAN while WLAN frame parsing due to missing frame length check.
Information disclosure due to buffer over-read in Bluetooth HOST while processing GetFolderItems and GetItemAttribute Cmds from peer device.
Denial of service in modem due to missing null check while processing IP packets with padding
Transient DOS can occur while processing UCI command.
Memory corruption due to improper validation of array index in Multi-mode call processor.
Memory corruption in Modem due to usage of Out-of-range pointer offset in UIM
Memory corruption in modem due to use of out of range pointer offset while processing qmi msg
Memory corruption while processing camera use case IOCTL call.
Memory corruption during voice activation, when sound model parameters are loaded from HLOS to ADSP.
Memory corruption during voice activation, when sound model parameters are loaded from HLOS, and the received sound model list is empty in HLOS drive.
Memory corruption due to improper validation of array index in WLAN HAL when received lm_itemNum is out of range.