Buffer Over-read in IOE Firmware

Information disclosure in IOE Firmware while handling WMI command.

Integer Overflow or Wraparound in Core Services

Memory corruption while processing a QMI request for allocating memory from a DHMS supported subsystem.

Buffer Over-read in WLAN Firmware

Transient DOS while parsing WPA IES, when it is passed with length more than expected size.

Buffer Over-read in Data Modem

Information Disclosure in Data Modem while performing a VoLTE call with an undefined RTCP FB line value.

Improper Input Validation in Multi-Mode Call Processor

Transient DOS while processing SMS container of non-standard size received in DL NAS transport in NR.

Buffer Over-read in WLAN Host Cmn

Memory corruption during management frame processing due to mismatch in T2LM info element.

Improper Input Validation in Services

Memory corruption in Core Services while executing the command for removing a single event listener.

Buffer Over-read in Data Modem

Memory Corruption in Data Modem while making a MO call or MT VOLTE call.

Reachable Assertion in WLAN Firmware

Transient DOS while processing 11AZ RTT management action frame received through OTA.

Configuration Issue in Core

Memory corruption in Core when updating rollback version for TA and OTA feature is enabled.

Buffer Copy without Checking Size of Input in HLOS

Memory corruption in HLOS while running playready use-case.

Possible use after free when process shell memory is freed using IOCTL call and process initialization is in progress in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking

Use of Out-of-range Pointer Offset in Audio

Memory corruption in Audio during playback with speaker protection.

Memory corruption in automotive multimedia due to use of out-of-range pointer offset while parsing command request packet with a very large type value. in Snapdragon Auto

Buffer Over-read in Multi-Mode Call Processor

Transient DOS while processing of a registration acceptance OTA due to incorrect ciphering key data IE.

Denial of service in WLAN due to out-of-bound read happens while processing VHT action frame in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking

Memory corruption in WLAN due to out of bound array access during connect/roaming in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Cryptographic issue in WLAN due to improper check on return value while authentication handshake in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking

memory corruption in video due to buffer overflow while parsing asf clips in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Transient DOS due to loop with unreachable exit condition in WLAN firmware while parsing IPV6 extension header. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking