Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in FM Host
Memory corruption when Alternative Frequency offset value is set to 255.
Memory corruption when Alternative Frequency offset value is set to 255.
Memory corruption in SPS Application while requesting for public key in sorter TA.
Memory corruption in HLOS while checking for the storage type.
Memory corruption in TZ Secure OS while loading an app ELF.
Transient DOS in WLAN Firmware while parsing rsn ies.
Information disclosure when VI calibration state set by ADSP is greater than MAX_FBSP_STATE in the response payload to AFE calibration command.
Memory corruption in WLAN Host when the firmware invokes multiple WMI Service Available command.
Memory corruption while processing Listen Sound Model client payload buffer when there is a request for Listen Sound session get parameter from ST HAL.
Memory corruption while processing a QMI request for allocating memory from a DHMS supported subsystem.
Transient DOS when WLAN firmware receives "reassoc response" frame including RIC_DATA element.
Transient DOS while key unwrapping process, when the given encrypted key is empty or NULL.
Memory corruption when resource manager sends the host kernel a reply message with multiple fragments.
Memory corruption in video while parsing the Videoinfo, when the size of atom is greater than the videoinfo size.
Memory Corruption in WLAN HOST while parsing QMI WLAN Firmware response message.
Memory Corruption in Core due to secure memory access by user while loading modem image.
Transient DOS while processing DL NAS TRANSPORT message with payload length 0.
Cryptographic issue occurs due to use of insecure connection method while downloading.
Memory corruption while processing finish_sign command to pass a rsp buffer.
Transient DOS while processing PDU Release command with a parameter PDU ID out of range.
Memory corruption while invoking IOCTLs calls in Automotive Multimedia.