Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN HAL

Memory corruption in WLAN HAL while processing WMI-UTF command or FTM TLV1 command.

Improper Authentication in HLOS.

Cryptographic issue in HLOS due to improper authentication while performing key velocity checks using more than one key.

Improper Validation of Array Index in Bluetooth HOST

Memory corruption in Bluetooth HOST while processing the AVRC_PDU_GET_PLAYER_APP_VALUE_TEXT AVRCP response.

Integer overflow or wraparound in WLAN

Memory corruption due to integer overflow or wraparound in WLAN while sending WMI cmd from host to target.

Incorrect type conversion in WLAN

Memory corruption in WLAN due to incorrect type cast while sending WMI_SCAN_SCH_PRIO_TBL_CMDID message.

Integer overflow to buffer overflow in WLAN

Memory corruption in WLAN due to integer overflow to buffer overflow in WLAN during initialization phase.

Information exposure in Kernel

Information disclosure in Kernel due to indirect branch misprediction.

Double free in Video

Memory corruption in Video due to double free while playing 3gp clip with invalid metadata atoms.

Buffer over-read in WLAN Firmware.

Transient DOS in WLAN Firmware due to buffer over-read while processing probe response or beacon.

Buffer over-read in Bluetooth Host.

Information disclosure due to buffer over-read in Bluetooth Host while A2DP streaming.

Buffer copy without checking the size of input in HLOS

Memory corruption due to buffer copy without checking the size of input in HLOS when input message size is larger than the buffer capacity.

Buffer copy without checking size of input in modem

Memory corruption in modem due to buffer copy without checking size of input while receiving WMI command.

Buffer over-read in WLAN

Information disclosure due to buffer over-read in WLAN while parsing NMF frame.

Time-of-check time-of-use race condition in Core

Memory corruption in Core due to time-of-check time-of-use race condition during dump collection in trust zone.

Use after free in WLAN

Memory corruption in WLAN due to use after free

Double free in Core

Memory corruption due to double free in core while initializing the encryption key.

Information disclosure in WLAN due to improper validation of array index while parsing crafted ANQP action frames in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music

Cryptographic issue in Core

information disclosure due to cryptographic issue in Core during RPMB read request.

Information Exposure in Graphics

Information Disclosure in Graphics during GPU context switch.

Out of bound read in WLAN HOST due to improper length check can lead to DOS in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables