Integer Overflow to Buffer Overflow in User Identity Module

Memory corruption while using the UIM diag command to get the operators name.

NULL pointer dereference in WLAN Firmware

Memory corruption when processing cmd parameters while parsing vdev.

Use of Out-of-range Pointer Offset in Audio

Memory corruption in Audio while processing RT proxy port register driver.

Buffer Over-read in WLAN HAL

Information disclosure in WLAN HAL while handling the WMI state info command.

Improper Input Validation in Services

Memory corruption in Core Services while executing the command for removing a single event listener.

Buffer Over-read in WLAN HAL

Information disclosure in WLAN HAL while handling command through WMI interfaces.

Integer Overflow or Wraparound in Audio

Memory Corruption in Audio while allocating the ion buffer during the music playback.

Use of Out-of-range Pointer Offset in Video

Memory corruption when the payload received from firmware is not as per the expected protocol size.

Buffer over-read in WLAN Firmware

Transient DOS while parsing a vender specific IE (Information Element) of reassociation response management frame.

Buffer Copy Without Checking Size of Input in WLAN HOST

Memory Corruption in WLAN HOST while processing WLAN FW request to allocate memory.

Integer Overflow to Buffer Overflow in HLOS

Memory corruption in HLOS while invoking IOCTL calls from user-space.

Improper Restriction of Operations within the Bounds of a Memory Buffer in MPP Performance

Memory corruption in MPP performance while accessing DSM watermark using external memory address.

Improper Restriction of Operations within the Bounds of a Memory Buffer in UTILS

Memory corruption in UTILS when modem processes memory specific Diag commands having arbitrary address values as input arguments.

Improper Authentication in Core

Memory Corruption in Core due to secure memory access by user while loading modem image.

Improper Restriction of Operation within the Bounds of a Memory Buffer in TZ Secure OS

Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE.

Use After Free in DSP Service

Memory corruption when two threads try to map and unmap a single node simultaneously.

Buffer Copy without Checking Size of Input in HLOS

Memory corruption in HLOS while running playready use-case.

Use of Out-of-range Pointer Offset in Audio

Memory corruption in Audio during playback with speaker protection.

Memory corruption in display due to time-of-check time-of-use of metadata reserved size in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables

Denial of service in WLAN due to out-of-bound read happens while processing VHT action frame in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking