Buffer over-read in WLAN Firmware

Transient DOS while parsing a vender specific IE (Information Element) of reassociation response management frame.

Buffer Over-read in WLAN Firmware

Transient DOS in WLAN Firmware while parsing rsn ies.

Integer Overflow to Buffer Overflow in User Identity Module

Memory corruption while using the UIM diag command to get the operators name.

Buffer Copy Without Checking Size of Input in Boot

Memory corruption in Boot while running a ListVars test in UEFI Menu during boot.

Integer Overflow to Buffer Overflow in HLOS

Memory corruption in HLOS while invoking IOCTL calls from user-space.

Buffer Copy Without Checking Size of Input in WLAN HAL

Memory corruption in WLAN HAL while processing devIndex from untrusted WMI payload.

Double free in Core

Memory corruption due to double free in Core while mapping HLOS address to the list.

Buffer Over-read in WLAN Firmware

Transient DOS in WLAN Firmware while processing frames with missing header fields.

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN HAL

Memory corruption in WLAN HAL while processing WMI-UTF command or FTM TLV1 command.

Integer overflow or wraparound in WLAN

Memory corruption due to integer overflow or wraparound in WLAN while sending WMI cmd from host to target.

Improper access control in Kernel

Memory corruption due to improper access control in kernel while processing a mapping request from root process.

Improper authorization in Modem

Transient DOS due to improper authorization in Modem

Reachable assertion in Modem

Transient DOS due to reachable assertion in Modem when UE received Downlink Data Indication message from the network.

Improper validation of array index in User Identity Module

Memory corruption due to improper validation of array index in User Identity Module when APN TLV length is greater than command length.

Integer overflow to buffer overflow in Modem

Memory corruption due to integer overflow to buffer overflow in Modem while parsing Traffic Channel Neighbor List Update message.

Improper validation of array index in Modem

Memory corruption occurs in Modem due to improper validation of array index when malformed APDU is sent from card.

Stack-based buffer overflow in Modem

Memory corruption in modem due to stack based buffer overflow while parsing OTASP Key Generation Request Message.

Double free in Core

Memory corruption due to double free in core while initializing the encryption key.

Cryptographic issue in Core

information disclosure due to cryptographic issue in Core during RPMB read request.

Buffer overflow in sahara protocol while processing commands leads to overwrite of secure configuration data in Snapdragon Mobile, Snapdragon Compute, Snapdragon Auto, Snapdragon IOT, Snapdragon Connectivity, Snapdragon Voice & Music