Information disclosure while parsing sub-IE length during new IE generation

Information disclosure while handling SA query action frame

INformation disclosure while handling Multi-link IE in beacon frame

Transient DOS in WLAN Firmware when the length of received beacon is less than length of ieee802.11 beacon frame

Transient DOS in WLAN Firmware while processing the received beacon or probe response frame

Transient DOS due to buffer over-read in WLAN Host while parsing frame information

Transient DOS due to buffer over-read in WLAN while processing an incoming management frame with incorrectly filled IEs

Stack-based Buffer Overflow in Display

Exposed Dangerous Method or Function in HLOS

Improper Input Validation in Trusted Execution Environment

Memory corruption while invoking redundant release command to release one buffer from user space as race condition can occur in kernel space between buffer release and buffer…

Memory corruption while loading a VM from a signed VM image that is not coherent in the processor cache

Out-of-bounds Write in Camera Driver

Buffer Copy Without Checking Size of Input in Camera Driver

Exposure of Sensitive System Information to an Unauthorized Control Sphere in HLOS

Use After Free in DSP Service

Buffer Copy Without Checking Size of Input in Audio

Use After Free in Data Network Stack & Connectivity

Use After Free in HLOS

Reachable Assertion in Modem

Weak Authentication in HLOS

Buffer Over-read in Core Services

Buffer Over-read in Video

Buffer Over-read in Video

Improper Authorization in SPS-HLOS

Transient DOS while importing a PKCS#8-encoded RSA key with zero bytes modulus

Information Disclosure in WLAN Host when processing WMI event command

Information disclosure in WLAN HOST while processing the WLAN scan descriptor list during roaming scan

Out-of-bounds Write in Camera Driver

Out-of-bounds Write in Camera Driver

Out-of-bounds Write in Camera Driver