Information disclosure while decoding RTP packet received by UE from the network, when payload length mentioned is greater than the available buffer length

Information disclosure when UE receives the RTP packet from the network, while decoding and reassembling the fragments from RTP packet

Information disclosure when an invalid RTCP packet is received during a VoLTE/VoWiFi IMS call

Information disclosure may occur while processing goodbye RTCP packet from network

Information disclosure may occur while decoding the RTP packet with improper header length for number of contributing sources

Memory corruption while processing GPU page table switch

Memory Corruption in Radio Interface Layer while sending an SMS or writing an SMS to SIM

Memory corruption in core services when Diag handler receives a command to configure event listeners

Memory corruption while processing audio effects

Memory corruption in Linux android due to double free while calling unregister provider after register call

Transient DOS during music playback of ALAC content

The session index variable in PCM host voice audio driver initialized before PCM open, accessed during event callback from ADSP and reset during PCM close may lead to race…

Memory corruption while unmapping the fastrpc map when two threads can free the same map in concurrent scenario

Memory corruption while processing IOCTL command to handle buffers associated with a session

Information disclosure in WLAN HAL when reception status handler is called