Search vulnerabilities
Buffer Over-read in Data Modem
Information Disclosure in Data Modem while performing a VoLTE call with an undefined RTCP FB line value.
Buffer Over-read in Data Modem
Information Disclosure in data Modem while parsing an FMTP line in an SDP message.
Improper Validation of Array Index in HLOS
Memory Corruption in HLOS while importing a cryptographic key into KeyMaster Trusted Application.
Improper Authentication in Core
Memory Corruption in Core due to secure memory access by user while loading modem image.
Buffer Copy Without Checking Size of Input in SPS Applications
Memory corruption in SPS Application while requesting for public key in sorter TA.
Buffer Over-read in WLAN Host
Memory Corruption in Data Modem while processing DMA buffer release event about CFR data.
Buffer Over-read in WLAN HOST
Memory Corruption in WLAN HOST while fetching TX status information.
Improper Restriction of Operations within the Bounds of a Memory Buffer in TZ Secure OS
Memory corruption in TZ Secure OS while loading an app ELF.
Improper Restriction of Operations within the Bounds of a Memory Buffer in MPP Performance
Memory corruption in MPP performance while accessing DSM watermark using external memory address.
Improper Restriction of Operations within the Bounds of a Memory Buffer in UTILS
Memory corruption in UTILS when modem processes memory specific Diag commands having arbitrary address values as input arguments.
Buffer Over-read in Qualcomm IPC
Information Disclosure in Qualcomm IPC while reading values from shared memory in VM.
Buffer Copy without Checking Size of Input in Audio
Memory corruption while processing audio effects.
Buffer Over-read in WLAN HOST
Information disclosure in WLAN HOST while processing the WLAN scan descriptor list during roaming scan.
Improper Restriction of Operation within the Bounds of a Memory Buffer in TZ Secure OS
Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE.
Improper Restriction of Operations within the Bounds of a Memory Buffer in BT Controller
Memory corruption in BT controller while parsing debug commands with specific sub-opcodes at HCI interface level.
Integer Overflow or Wraparound in Bluetooth Host
Transient DOS in Bluetooth Host while rfc slot allocation.
Integer Overflow to Buffer Overflow in HLOS
Memory corruption in HLOS while invoking IOCTL calls from user-space.
Buffer Copy without Checking Size of Input (`Classic Buffer Overflow`) in SPS-Applications
Memory corruption while processing finish_sign command to pass a rsp buffer.