Information Disclosure in Data Modem while performing a VoLTE call with an undefined RTCP FB line value.
Information Disclosure in data Modem while parsing an FMTP line in an SDP message.
Memory corruption in Core Services while executing the command for removing a single event listener.
Transient DOS in Bluetooth Host while rfc slot allocation.
Memory corruption while processing finish_sign command to pass a rsp buffer.
Memory corruption while using the UIM diag command to get the operators name.
Transient DOS in WLAN Firmware while parsing rsn ies.
Memory corruption in Audio while processing RT proxy port register driver.
Transient DOS while parsing a vender specific IE (Information Element) of reassociation response management frame.
Memory corruption in MPP performance while accessing DSM watermark using external memory address.
Memory corruption in UTILS when modem processes memory specific Diag commands having arbitrary address values as input arguments.
Cryptographic issue while performing attach with a LTE network, a rogue base station can skip the authentication phase and immediately send the Security Mode Command.
Memory corruption in HLOS while running playready use-case.
The session index variable in PCM host voice audio driver initialized before PCM open, accessed during event callback from ADSP and reset during PCM close may lead to race condition between event callback - PCM close and reset session index causing memory corruption.
Memory corruption in Audio during playback with speaker protection.
Memory corruption in WLAN while sending transmit command from HLOS to UTF handlers.
Memory corruption in WLAN HAL while parsing Rx buffer in processing TLV payload.
Memory corruption in WLAN FW while processing command parameters from untrusted WMI payload.
Memory corruption in WLAN HAL while processing devIndex from untrusted WMI payload.