Information disclosure in Core services while processing a Diag command

Memory Corruption in Modem due to double free while parsing the PKCS15 sim files

Out-of-bounds Write in Camera Driver

Memory corruption while accessing a synchronization object during concurrent operations

Memory corruption while processing multiple IOCTL calls from HLOS to DSP

Memory corruption while invoking IOCTL command from user-space, when a user modifies the original packet size of the command after system properties have been already sent to the…

Memory corruption may occur while processing voice call registration with user

Memory corruption while accessing MSM channel map and mixer functions

Exposure of Private Personal Information to an Unauthorized Actor in Data Modem

Transient DOS when an LTE RLC packet with invalid TB is received by UE

Transient DOS during hypervisor virtual I/O operation in a virtual machine

Transient DOS while processing the CU information from RNR IE

Information disclosure when ASLR relocates the IMEM and Secure DDR portions as one chunk in virtual address space

Memory corruption while handling sensor utility operations

Memory corruption while processing a config call from userspace

Information disclosure while running video usecase having rogue firmware

Information disclosure while capturing logs as eSE debug messages are logged

Information disclosure during audio playback

Buffer Over-read in DSP Service

Buffer Over-read in FM Host

Transient DOS in Core when DDR memory check is called while DDR is not initialized

Cryptographic issue in Automotive while unwrapping the key secs2d and verifying with RPMB data

Permanent DOS in Hypervisor while untrusted VM without PSCI support makes a PSCI call

Transient DOS due to untrusted Pointer Dereference in core while sending USB QMI request

Out-of-bounds Write in Camera Driver

Out-of-bounds Write in Camera Driver