Buffer Copy Without Checking Size of Input in WLAN HAL
Memory corruption in WLAN HAL while processing devIndex from untrusted WMI payload.
Export limit exceeded: 425825 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Memory corruption in WLAN HAL while processing devIndex from untrusted WMI payload.
Memory corruption while handling payloads from remote ESL.
Memory corruption in WLAN HAL while passing command parameters through WMI interfaces.
Memory corruption in WLAN HAL while handling command streams through WMI interfaces.
Memory corruption in WLAN HAL while handling command through WMI interfaces.
Memory corruption due to double free in Core while mapping HLOS address to the list.
Memory corruption while invoking IOCTL calls from user space to issue factory test command inside WLAN driver.
Memory corruption during session sign renewal request calls in HLOS.
Transient DOS while importing a PKCS#8-encoded RSA key with zero bytes modulus.
Memory corruption when an invoke call and a TEE call are bound for the same trusted application.
Memory corruption while processing key blob passed by the user.
Memory corruption while performing finish HMAC operation when context is freed by keymaster.
Transient DOS while parsing GATT service data when the total amount of memory that is required by the multiple services is greater than the actual size of the services buffer.
Transient DOS in WLAN Firmware while interpreting MBSSID IE of a received beacon frame.
Memory corruption in QESL while processing payload from external ESL device to firmware.
Memory corruption in WLAN handler while processing PhyID in Tx status handler.
Memory corruption in WLAN HAL while processing command parameters from untrusted WMI payload.
Cryptographic issue in HLOS as derived keys used to encrypt/decrypt information is present on stack after use.
Memory Corruption in Core due to incorrect type conversion or cast in secure_io_read/write function in TEE.