Qualcomm

Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values.

Memory Corruption when copying unverified data from an external source exceeds the allocated buffer size.

Transient DOS when processing authentication frames with invalid FILS information element header lengths.

Memory corruption when processing draw objects of incorrect type during graphics command list execution.

Memory Corruption when validating large data buffers from external sources using addition to check buffer length.

Memory corruption when processing escape handling flow with insufficient user buffer sizes.

Memory Corruption when processing asynchronous input parameters due to improper handling of modified values between check and use.

Memory corruption while processing rear sensor IOCTL calls.

Memory Corruption when handling malformed request parameters in the fingerprint TA.

Memory Corruption when multiple threads issue concurrent IOCTL requests to the device control handler due to improper synchronization and race conditions.

Memory Corruption when processing data with large offset and length values exceeds buffer limits during data copy operations.

Memory corruption when processing decode statistics due to insufficient validation of offset against structure size.

Memory Corruption when handling power management requests with improperly sized input/output buffers.

Memory Corruption when using deprecated DMABUF IOCTL calls to manage video memory.

Memory Corruption when allocating memory with sizes that exceed the maximum allowed value.

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver.

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver.

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing.

Memory Corruption when processing auxiliary sensor input/output control commands with insufficient buffer size validation.

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing.

Memory Corruption when sending IOCTL requests with invalid buffer sizes during memcpy operations.

Memory Corruption when retrieving output buffer with insufficient size validation.

Memory Corruption when copying large input data exceeds normal allocation limits.

Memory Corruption when writing to invalid memory locations occurs due to heap memory exhaustion during secure data initialization.

Memory Corruption when running a memory copy operation due to invalid writes caused by a null pointer.