Memory Corruption in camera while installing a fd for a particular DMA buffer

Memory corruption in Audio while processing the VOC packet data from ADSP

Memory corruption in Automotive Audio while copying data from ADSP shared buffer to the VOC packet data buffer

Cryptographic issue in HLOS during key management

Memory Corruption in Core due to secure memory access by user while loading modem image

The cam_get_device_priv function does not check the type of handle being returned (device/session/link)

Memory Corruption in WLAN HOST while fetching TX status information

Memory Corruption in Data Modem while processing DMA buffer release event about CFR data

Arbitrary memory overwrite when VM gets compromised in TX write leading to Memory Corruption

Memory corruption due to improper access control in kernel while processing a mapping request from root process

Memory corruption due to double free in Core while mapping HLOS address to the list

Memory corruption in modem due to stack based buffer overflow while parsing OTASP Key Generation Request Message

Memory corruption in Graphics while importing a file

Memory corruption due to improper validation of array index in User Identity Module when APN TLV length is greater than command length

Memory corruption due to double free in core while initializing the encryption key

Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request

Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request from the AP to establish a TSpec session

Cryptographic issue while performing attach with a LTE network, a rogue base station can skip the authentication phase and immediately send the Security Mode Command

Transient DOS while decoding the ToBeSignedMessage in Automotive Telematics

Transient DOS while decoding message of size that exceeds the available system memory

Transient DOS while decoding an ASN.1 OER message containing a SEQUENCE of unknown extensions

Information Disclosure in Data Modem while performing a VoLTE call with an undefined RTCP FB line value

Transient DOS in Modem while allocating DSM items

Transient DOS in WLAN Host when an invalid channel (like channel out of range) is received in STA during CSA IE

Transient DOS in WLAN Host while doing channel switch announcement (CSA), when a mobile station receives invalid channel in CSA IE

Transient DOS due to improper authorization in Modem

Information disclosure due to buffer over-read in Bluetooth Host while A2DP streaming

Improper Validation of Syntactic Correctness of Input in Display

Missing Cryptographic Step in Data Modem

Cryptographic Issues in Core

Information disclosure in Audio while accessing AVCS services from ADSP payload

Memory corruption while parsing the memory map info in IOCTL calls