Memory corruption while parsing qcp clip with invalid chunk data size

Memory corruption in video while parsing the Videoinfo, when the size of atom is greater than the videoinfo size

Memory corruption in video while parsing invalid mp2 clip

Memory corruption while handling payloads from remote ESL

Memory corruption in QESL while processing payload from external ESL device to firmware

Memory corruption in Bluetooth HOST while processing the AVRC_PDU_GET_PLAYER_APP_VALUE_TEXT AVRCP response

Memory corruption in Video due to double free while playing 3gp clip with invalid metadata atoms

Memory corruption in video due to configuration weakness

Possible buffer overflow due to improper validation of SSID length received from beacon or probe response during an IBSS session in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Possible out of bound read due to improper validation of certificate chain in SSL or Internet key exchange in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

u'Buffer over-read while processing received L2CAP packet due to lack of integer overflow check' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Memory corruption in Bluetooth HOST due to buffer overflow while parsing the command response received from remote

u'Buffer overflow while processing PDU packet in bluetooth due to lack of check of buffer length before copying into it.' in Snapdragon Auto, Snapdragon Compute, Snapdragon…

u'Buffer overflow while processing a crafted PDU data packet in bluetooth due to lack of check of buffer size before copying' in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Memory corruption may occur while reading board data via IOCTL call when the WLAN driver copies the content to the provided output buffer

Memory corruption while IOCTL call is invoked from user-space to read board data

Stack-based Buffer Overflow in WLAN Windows Host

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN Windows Host

Memory corruption while invoking IOCTL calls from user space to issue factory test command inside WLAN driver

Memory corruption when an invoke call and a TEE call are bound for the same trusted application

Memory corruption while copying a keyblob`s material when the key material`s size is not accurately checked

Memory corruption in HLOS while invoking IOCTL calls from user-space

Memory corruption in BT controller while parsing debug commands with specific sub-opcodes at HCI interface level

Cryptographic issue in HLOS during key management

Memory corruption in TZ Secure OS while loading an app ELF

Memory Corruption in HLOS while importing a cryptographic key into KeyMaster Trusted Application

Memory corruption in WIN Product while invoking WinAcpi update driver in the UEFI region

Memory Corruption in Core due to incorrect type conversion or cast in secure_io_read/write function in TEE

Memory corruption due to double free in core while initializing the encryption key

Memory corruption due to buffer copy without checking the size of input in HLOS when input message size is larger than the buffer capacity

Memory corruption in WLAN due to use after free

Memory corruption due to use after free issue in kernel while processing ION handles in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…

Improper validation of program headers containing ELF metadata can lead to image verification bypass in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Possible null pointer dereference due to lack of TLB validation for user provided address in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…

Memory corruption due to improper input validation while processing IO control which is nonstandard in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics…

u'SMEM partition can be manipulated in case of any compromise on HLOS, thus resulting in access to memory outside of SMEM address range which could lead to memory corruption' in…

Close and bind operations done on a socket can lead to a Use-After-Free condition

Transient DOS while parsing the EPTM test control message to get the test pattern

Transient DOS while processing an ANQP message

Transient DOS while parsing GATT service data when the total amount of memory that is required by the multiple services is greater than the actual size of the services buffer

Transient DOS in Bluetooth Host while rfc slot allocation

Information disclosure due to buffer over-read in Bluetooth Host while A2DP streaming

Information disclosure in WLAN due to improper validation of array index while parsing crafted ANQP action frames in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Out of bound read in WLAN HOST due to improper length check can lead to DOS in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics…

Possible buffer over read due to lack of size validation while unpacking frame in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics…

Improper Input Validation in Trusted Execution Environment

Cryptographic issue in HLOS as derived keys used to encrypt/decrypt information is present on stack after use

Cryptographic issue in HLOS due to improper authentication while performing key velocity checks using more than one key

Possible out of bound read due to lack of length check of data length for a DIAG event in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…

Memory corruption in Core due to time-of-check time-of-use race condition during dump collection in trust zone