Qualcomm

Memory corruption in WLAN Firmware while doing a memory copy of pmk cache.

Memory corruption in WLAN due to integer overflow to buffer overflow while parsing GTK frames.

Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions.

Possible heap overflow due to improper length check of domain while parsing the DNS response in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon…

Buffer overflow can occur in video while playing the non-standard clip in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Vo…

u'Buffer over read can happen while parsing mkv clip due to improper typecasting of data returned from atomsize' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobi…

u'Possible buffer overflow will occur in video while parsing mp4 clip with crafted esds atom size.' in Snapdragon Auto, Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile in QCM4290, QCS4290, QM215, QSM8350…

u'Null-pointer dereference can occur while accessing data buffer beyond its size that leads to access the buffer beyond its range' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IO…

u'When a non standard SIP sigcomp message is received from the network, then there may be chances of using more UDVM cycle or memory overflow' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon I…

Memory corruption due to buffer copy without checking the size of input in WLAN Firmware while processing CCKM IE in reassoc response frame.

Null Pointer Dereference may occur due to improper validation while processing crafted SDP body in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdra…

Information disclosure due to buffer over-read in WLAN while parsing BTM action frame.

Information disclosure due to buffer over-read in WLAN while WLAN frame parsing due to missing frame length check.

Information disclosure due to buffer over-read in WLAN while parsing NMF frame.

Information disclosure due to buffer over-read in WLAN firmware while parsing security context info attributes.

Memory corruption in Hypervisor when platform information mentioned is not aligned.

Memory corruption in TZ Secure OS while Tunnel Invoke Manager initialization.

Memory corruption in Core while processing control functions.

Memory corruption in HLOS while running playready use-case.

Memory corruption in Core Services while executing the command for removing a single event listener.

Memory Corruption in Core during syscall for Sectools Fuse comparison feature.

Memory Corruption in Core due to incorrect type conversion or cast in secure_io_read/write function in TEE.

Memory corruption due to double free in Core while mapping HLOS address to the list.

Memory corruption in Core due to time-of-check time-of-use race condition during dump collection in trust zone.

Information disclosure due to buffer over-read in WLAN while handling IBSS beacons frame.