Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN Host

Memory corruption in WLAN Host while processing RRM beacon on the AP.

Buffer Over-read in WLAN Firmware

Transient DOS in WLAN Firmware while interpreting MBSSID IE of a received beacon frame.

Improper Validation of Array Index in WLAN HAL

Memory corruption in WLAN HAL while parsing WMI command parameters.

Improper Validation of Array Index in WLAN HAL

Memory corruption in WLAN HAL while processing command parameters from untrusted WMI payload.

Buffer Over-read in WLAN Firmware

Transient DOS while parsing WLAN beacon or probe-response frame.

Buffer Over-read in WLAN Firmware

Transient DOS in WLAN Firmware while processing frames with missing header fields.

Buffer Over-Read in WLAN Firmware

Transient DOS in WLAN Firmware while processing the received beacon or probe response frame.

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN HAL

Memory corruption in WLAN HAL while processing WMI-UTF command or FTM TLV1 command.

Integer overflow or wraparound in WLAN

Memory corruption due to integer overflow or wraparound in WLAN while sending WMI cmd from host to target.

Incorrect type conversion in WLAN

Memory corruption in WLAN due to incorrect type cast while sending WMI_SCAN_SCH_PRIO_TBL_CMDID message.

Buffer copy without checking size of input in WLAN Firmware

Memory corruption due to buffer copy without checking the size of input in WLAN Firmware while processing CCKM IE in reassoc response frame.

Buffer over-read in WLAN Firmware.

Transient DOS in WLAN Firmware due to buffer over-read while processing probe response or beacon.

Buffer over-read in WLAN

Transient DOS due to buffer over-read in WLAN while processing an incoming management frame with incorrectly filled IEs.

Buffer copy without checking size of input in modem

Memory corruption in modem due to buffer copy without checking size of input while receiving WMI command.

Buffer over-read in WLAN

Information disclosure due to buffer over-read in WLAN while parsing NMF frame.

Improper access control in Qualcomm IPC

Memory corruption due to improper access control in Qualcomm IPC.

Buffer copy without checking the size of input in WLAN HAL.

Memory corruption in WLAN HAL while arbitrary value is passed in WMI UTF command payload.

Possible out of bound access of DCI resources due to lack of validation process and resource allocation in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking

Use after free condition can occur in wired connectivity due to a race condition while creating and deleting folders in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking

Possible buffer overflow due to lack of buffer length check when segmented WMI command is received in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking