Qualcomm

Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.

Memory corruption while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND.

Memory corruption while using alignments for memory allocation.

Memory corruption while maintaining memory maps of HLOS memory.

Memory corruption in DSP Services during a remote call from HLOS to DSP.

Memory corruption when the UE receives an RTP packet from the network, during the reassembly of NALUs.

Memory corruption in WLAN due to integer overflow to buffer overflow while parsing GTK frames.

Memory corruption in WLAN due to out of bound array access during connect/roaming in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Sn…

Memory corruption while playing audio file having large-sized input buffer.

Memory corruption while parsing qcp clip with invalid chunk data size.

Memory corruption in video while parsing the Videoinfo, when the size of atom is greater than the videoinfo size.

memory corruption in video due to buffer overflow while parsing asf clips in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon…

Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions.

Possible buffer overflow due to improper parsing of headers while playing the FLAC audio clip in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdrago…

Memory corruption while processing Codec2 during v13k decoder pitch synthesis.

Memory corruption due to buffer copy without checking the size of input in WLAN Firmware while processing CCKM IE in reassoc response frame.

Memory corruption in video while parsing invalid mp2 clip.

Information disclosure due to buffer over-read in WLAN while parsing NMF frame.

Information disclosure due to buffer over-read in WLAN firmware while parsing security context info attributes.

Information disclosure while decoding RTP packet received by UE from the network, when payload length mentioned is greater than the available buffer length.

Information disclosure when UE receives the RTP packet from the network, while decoding and reassembling the fragments from RTP packet.

Information disclosure while decoding this RTP packet Payload when UE receives the RTP packet from the network.

Information disclosure when an invalid RTCP packet is received during a VoLTE/VoWiFi IMS call.

Information disclosure may occur while processing goodbye RTCP packet from network.

Information disclosure may occur while decoding the RTP packet with invalid header extension from network.