Memory corruption in Core Services while executing the command for removing a single event listener.
Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE.
Transient DOS while processing TIM IE from beacon frame as there is no check for IE length.
Memory corruption when user provides data for FM HCI command control operations.
Memory corruption in BT controller while parsing debug commands with specific sub-opcodes at HCI interface level.
Memory corruption when two threads try to map and unmap a single node simultaneously.
Transient DOS in WLAN Firmware when the length of received beacon is less than length of ieee802.11 beacon frame.
Memory corruption while processing IOCTL call for getting group info.
Transient DOS in Bluetooth Host while rfc slot allocation.
Memory corruption in HLOS while invoking IOCTL calls from user-space.
Memory corruption while processing finish_sign command to pass a rsp buffer.
Memory corruption in Boot while running a ListVars test in UEFI Menu during boot.
Information disclosure while deriving keys for a session for any Widevine use case.
Memory corruption in HLOS while checking for the storage type.
Memory corruption while using the UIM diag command to get the operators name.
Transient DOS in WLAN Firmware while parsing a NAN management frame.
Transient DOS in WLAN Firmware while parsing rsn ies.
Memory corruption when IOCTL call is invoked from user-space to read board data.
Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver.