Buffer Copy Without Checking Size of Input in WLAN Host
Transient DOS may occur while processing the country IE.
Transient DOS may occur while processing the country IE.
Transient DOS when importing a PKCS#8-encoded RSA private key with a zero-sized modulus.
Transient DOS while processing received beacon frame.
Memory corruption in HLOS while running playready use-case.
The session index variable in PCM host voice audio driver initialized before PCM open, accessed during event callback from ADSP and reset during PCM close may lead to race condition between event callback - PCM close and reset session index causing memory corruption.
Memory corruption in Audio during playback with speaker protection.
Memory corruption in WIN Product while invoking WinAcpi update driver in the UEFI region.
Memory corruption in WLAN while sending transmit command from HLOS to UTF handlers.
Memory corruption in WLAN FW while processing command parameters from untrusted WMI payload.
Memory corruption in WLAN HAL while processing devIndex from untrusted WMI payload.
Memory corruption in WLAN HAL while passing command parameters through WMI interfaces.
Memory corruption in WLAN HAL while handling command streams through WMI interfaces.
Memory corruption in WLAN HAL while handling command through WMI interfaces.
Memory corruption due to double free in Core while mapping HLOS address to the list.
Memory Corruption in GPU Subsystem due to arbitrary command execution from GPU in privileged mode.
Transient DOS while handling PS event when Program Service name length offset value is set to 255.
Memory corruption when allocating and accessing an entry in an SMEM partition continuously.
Memory corruption during session sign renewal request calls in HLOS.
Transient DOS while decoding attach reject message received by UE, when IEI is set to ESM_IEI.
Transient DOS while importing a PKCS#8-encoded RSA key with zero bytes modulus.