Transient DOS while processing multiple payload container type with incorrect container length received in DL NAS transport OTA in NR

Transient DOS in Multi-Mode Call Processor while processing UE policy container

Transient DOS in Multi-Mode Call Processor due to UE failure because of heap leakage

Memory corruption in Trusted Execution Environment while deinitializing an object used for license validation

Memory corruption while accessing a synchronization object during concurrent operations

Memory corruption while processing shared command buffer packet between camera userspace and kernel

Memory corruption while invoking IOCTL command from user-space, when a user modifies the original packet size of the command after system properties have been already sent to the…

Memory corruption while handling buffer mapping operations in the cryptographic driver

Transient DOS while parsing fragments of MBSSID IE from beacon frame

Transient DOS as modem reset occurs when an unexpected MAC RAR (with invalid PDU length) is seen at UE

Information disclosure when ASLR relocates the IMEM and Secure DDR portions as one chunk in virtual address space

Memory corruption while processing a config call from userspace

Transient DOS when importing a PKCS#8-encoded RSA private key with a zero-sized modulus

There may be information disclosure during memory re-allocation in TZ Secure OS

Transient DOS in Core when DDR memory check is called while DDR is not initialized