Out-of-bounds Read in Core

Information disclosure while reading data from an image using specified offset and size parameters.

Buffer Over-read in BT Controller

Transient DOS while parsing the EPTM test control message to get the test pattern.

Reachable Assertion in WLAN Firmware

Transient DOS while processing an ANQP message.

Reachable Assertion in BT Controller

Transient DOS when a remote device sends an invalid connection request during BT connectable LE scan.

Integer Overflow or Wraparound in Graphics Linux

Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.

Memory corruption due to improper check to return error when user application requests memory allocation of a huge size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Improper handling of address deregistration on failure can lead to new GPU address allocation failure. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Use After Free in DSP Services

Memory corruption in DSP Services during a remote call from HLOS to DSP.

Use After Free in HLOS

Memory corruption while handling file descriptor during listener registration/de-registration.

Buffer Over-read in WLAN Firmware

Transient DOS may occur while parsing SSID in action frames.

Buffer Over-read in WLAN Host

Transient DOS while connecting STA to AP and initiating ADD TS request from AP to establish TSpec session.

Improper Restriction of Operations within the Bounds of a Memory Buffer in Storage

memory corruption when an invalid firehose patch command is invoked.

Buffer Over-read in Multi Mode Call Processor

Information disclosure while decoding Tracking Area Update Accept or Attach Accept message received from network.

Buffer Over-read in WLAN HOST

Information disclosure while handling beacon or probe response frame in STA.

Buffer Over-read in WLAN HOST

Memory Corruption in WLAN HOST while fetching TX status information.

Integer Overflow or Wraparound in Audio

Memory Corruption in Audio while allocating the ion buffer during the music playback.

Buffer Copy without Checking Size of Input (`Classic Buffer Overflow`) in SPS-Applications

Memory corruption while processing finish_sign command to pass a rsp buffer.

Double Free in Modem

Memory Corruption in Modem due to double free while parsing the PKCS15 sim files.

Improper Authorization in HLOS

Cryptographic issue in HLOS during key management.

Improper Release of Memory Before Removing Last Reference in Data Modem

Transient DOS while processing multiple IKEV2 Informational Request to device from IPSEC server with different identifiers.