Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Qualcomm IPC
Memory corruption when allocating and accessing an entry in an SMEM partition.
Memory corruption when allocating and accessing an entry in an SMEM partition.
Memory corruption while performing finish HMAC operation when context is freed by keymaster.
Memory corruption in Graphics while processing user packets for command submission.
Transient DOS in WLAN Host when an invalid channel (like channel out of range) is received in STA during CSA IE.
Transient DOS in WLAN Host while doing channel switch announcement (CSA), when a mobile station receives invalid channel in CSA IE.
Memory Corruption in Graphics while accessing a buffer allocated through the graphics pool.
Memory corruption in Graphics while importing a file.
Memoru corruption in Audio when ADSP sends input during record use case.
Memory corruption in WLAN while running doDriverCmd for an unspecific command.
Memory corruption in WLAN HAL while processing WMI-UTF command or FTM TLV1 command.
Information disclosure in Network Services due to buffer over-read while the device receives DNS response.
Memory corruption in Bluetooth HOST while processing the AVRC_PDU_GET_PLAYER_APP_VALUE_TEXT AVRCP response.
Memory corruption due to integer overflow or wraparound in WLAN while sending WMI cmd from host to target.
Memory corruption in WLAN due to incorrect type cast while sending WMI_SCAN_SCH_PRIO_TBL_CMDID message.
Memory corruption in Video due to double free while playing 3gp clip with invalid metadata atoms.
Transient DOS in WLAN Firmware due to buffer over-read while processing probe response or beacon.
Memory corruption due to buffer copy without checking size of input in Audio while voice call with EVS vocoder.
Information disclosure due to buffer over-read in Bluetooth Host while A2DP streaming.
Memory corruption due to improper validation of array index in User Identity Module when APN TLV length is greater than command length.