Incorrect Authorization in Graphics

Incorrect Authorization in Graphics Windows

Memory corruption while selecting the PLMN from SOR failed list

Integer Overflow or Wraparound in Display

Memory corruption when the mapped pages in VBO are still mapped after reclaiming by shrinker

Information disclosure while decoding this RTP packet headers received by UE from the network when the padding bit is set

Information disclosure while decoding RTP packet received by UE from the network, when payload length mentioned is greater than the available buffer length

Information disclosure when UE receives the RTP packet from the network, while decoding and reassembling the fragments from RTP packet

Information disclosure may occur while processing goodbye RTCP packet from network

Information disclosure may occur while decoding the RTP packet with improper header length for number of contributing sources

Buffer Over-read in Multi Mode Call Processor

Incorrect Authorization in Boot

Memory corruption while performing private key encryption in trusted application

Memory corruption while handling client exceptions, allowing unauthorized channel access

Memory corruption while handling file descriptor during listener registration/de-registration

Memory corruption during GNSS HAL process initialization

Memory corruption when kernel driver attempts to trigger hardware fences

Memory corruption while processing graphics kernel driver request to create DMA fence

Memory corruption when memory mapped in a VBO is not unmapped by the GPU SMMU

Memory corruption when keymaster operation imports a shared key

Transient DOS while processing an ANQP message

Transient DOS while processing CCCH data when NW sends data with invalid length

Transient DOS while processing a random-access response (RAR) with an invalid PDU length on LTE network

Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request

Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon

Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero

Transient DOS when NAS receives ODAC criteria of length 1 and type 1 in registration accept OTA

Buffer Copy Without Checking Size of Input in Camera Driver

Memory corruption while processing IOCTL command to handle buffers associated with a session

Memory corruption while accessing MSM channel map and mixer functions

Memory corruption while invoking IOCTL map buffer request from userspace

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver

Information disclosure while sending implicit broadcast containing APP launch information