Integer Overflow to Buffer Overflow in Bluetooth HOST
Memory corruption in Bluetooth HOST due to buffer overflow while parsing the command response received from remote
Memory corruption in Bluetooth HOST due to buffer overflow while parsing the command response received from remote
Denial of service while processing fastboot flash command on mmc due to buffer over read
Information disclosure due to buffer over-read in Bluetooth HOST while processing GetFolderItems and GetItemAttribute Cmds from peer device.
Memory corruption in Modem due to usage of Out-of-range pointer offset in UIM
Memory corruption due to double free in Core while mapping HLOS address to the list.
Transient DOS while handling PS event when Program Service name length offset value is set to 255.
Memory corruption while processing API calls to NPU with invalid input.
Memory corruption when allocating and accessing an entry in an SMEM partition continuously.
Transient DOS while decoding attach reject message received by UE, when IEI is set to ESM_IEI.
Transient DOS in WLAN Host when an invalid channel (like channel out of range) is received in STA during CSA IE.
Transient DOS in WLAN Host while doing channel switch announcement (CSA), when a mobile station receives invalid channel in CSA IE.
Memory corruption while allocating memory in COmxApeDec module in Audio.
Memory Corruption in Audio while playing amrwbplus clips with modified content.
Memory Corruption in Graphics while accessing a buffer allocated through the graphics pool.
Memory corruption in Graphics while importing a file.
Cryptographic issue in HLOS due to improper authentication while performing key velocity checks using more than one key.
Information disclosure in Network Services due to buffer over-read while the device receives DNS response.
Memory corruption in Bluetooth HOST while processing the AVRC_PDU_GET_PLAYER_APP_VALUE_TEXT AVRCP response.
Memory corruption due to integer overflow or wraparound in WLAN while sending WMI cmd from host to target.