Qualcomm

Transient DOS in Automotive OS due to improper authentication to the secure IO calls.

Memory corruption while parsing the ML IE due to invalid frame content.

Memory corruption during management frame processing due to mismatch in T2LM info element.

Memory corruption while playing audio file having large-sized input buffer.

Information disclosure while parsing the OCI IE with invalid length.

Memory corruption in Hypervisor when platform information mentioned is not aligned.

Memory corruption in TZ Secure OS while Tunnel Invoke Manager initialization.

Memory corruption in Core while processing control functions.

Memory corruption in HLOS while running playready use-case.

Memory corruption in Core Services while executing the command for removing a single event listener.

Memory Corruption in Core due to incorrect type conversion or cast in secure_io_read/write function in TEE.

Memory corruption due to double free in Core while mapping HLOS address to the list.

Memory corruption in Core due to time-of-check time-of-use race condition during dump collection in trust zone.

Memory corruption due to buffer copy without checking size of input while running memory sharing tests with large scattered memory.

Memory corruption in Automotive due to integer overflow to buffer overflow while registering a new listener with shared buffer.

Transient DOS while connecting STA to AP and initiating ADD TS request from AP to establish TSpec session.

Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request.

Memory corruption due to stack-based buffer overflow in Core

Memory corruption in Core due to stack-based buffer overflow.

Memory corruption while reading a value from a buffer controlled by the Guest Virtual Machine.

Transient DOS may occur while processing the country IE.

Transient DOS can occur when the driver parses the per STA profile IE and tries to access the EXTN element ID without checking the IE length.

Memory corruption while configuring a Hypervisor based input virtual device.

Transient DOS when transmission of management frame sent by host is not successful and error status is received in the host.

Transient DOS while parsing the multi-link element Control field when common information length check is missing before updating the location.