Use After Free in Camera Driver

Buffer Copy Without Checking Size of Input in Camera Driver

Memory corruption while invoking IOCTL command from user-space, when a user modifies the original packet size of the command after system properties have been already sent to the…

Use After Free in HLOS

Transient DOS while parsing fragments of MBSSID IE from beacon frame

Transient DOS as modem reset occurs when an unexpected MAC RAR (with invalid PDU length) is seen at UE

Information disclosure when ASLR relocates the IMEM and Secure DDR portions as one chunk in virtual address space

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver

NULL Pointer Dereference in SPS-HLOS

Information Exposure in TZ Secure OS

Transient DOS in Core when DDR memory check is called while DDR is not initialized