Buffer Copy Without Checking Size of Input in Secure Processor

Improper Validation of Array Index in Secure Processor

Integer Overflow or Wraparound in GPS

Memory corruption in WLAN HOST while processing the WLAN scan descriptor list

Missing Authentication for Critical Function in Data Modem

NULL Pointer Dereference in SPS Applications

Improper Input Validation in Video Analytics and Processing

Buffer Copy Without Checking Size of Input in Graphics Linux

Use After Free in Computer Vision

Memory Corruption in Audio while invoking IOCTLs calls from the user-space

Memory Corruption in camera while installing a fd for a particular DMA buffer

Memory Corruption in Radio Interface Layer while sending an SMS or writing an SMS to SIM

Memory corruption while processing audio effects

Exposure of Sensitive System Information to an Unauthorized Control Sphere in HLOS

Use After Free in Camera Driver

The session index variable in PCM host voice audio driver initialized before PCM open, accessed during event callback from ADSP and reset during PCM close may lead to race…