Qualcomm

Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.

Memory corruption while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND.

Memory corruption while using alignments for memory allocation.

Memory corruption in DSP Services during a remote call from HLOS to DSP.

Transient DOS in Automotive OS due to improper authentication to the secure IO calls.

Memory corruption while parsing the ML IE due to invalid frame content.

Memory corruption in WLAN Firmware while parsing a NAN management frame carrying a S3 attribute.

Memory corruption in WLAN Firmware while doing a memory copy of pmk cache.

Memory corruption when the UE receives an RTP packet from the network, during the reassembly of NALUs.

Memory corruption while parsing beacon/probe response frame when AP sends more supported links in MLIE.

Memory corruption while processing MBSSID beacon containing several subelement IE.

Memory corruption during management frame processing due to mismatch in T2LM info element.

Memory corruption while playing audio file having large-sized input buffer.

Memory corruption while parsing qcp clip with invalid chunk data size.

Memory corruption while validating the TID to Link Mapping action request frame, when a station connects to an access point.

Memory corruption when AP includes TID to link mapping IE in the beacons and STA is parsing the beacon TID to link mapping IE.

Memory corruption in video while parsing the Videoinfo, when the size of atom is greater than the videoinfo size.

Information Disclosure while parsing beacon frame in STA.

Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions.

Memory corruption while processing Codec2 during v13k decoder pitch synthesis.

Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values.

Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE.

Memory corruption in video while parsing invalid mp2 clip.

Information disclosure while decoding RTP packet received by UE from the network, when payload length mentioned is greater than the available buffer length.

Information disclosure when UE receives the RTP packet from the network, while decoding and reassembling the fragments from RTP packet.