Exposure of Sensitive System Information to an Unauthorized Control Sphere in HLOS

Memory corruption while processing the update SIM PB records request

Memory corruption while parsing IPC frequency table parameters for LPLH that has size greater than expected size

Reachable Assertion in BT Controller

Transient DOS while processing the CU information from RNR IE

Transient DOS while parsing BTM ML IE when per STA profile is not included

Transient DOS while parsing fragments of MBSSID IE from beacon frame

Transient DOS as modem reset occurs when an unexpected MAC RAR (with invalid PDU length) is seen at UE

Permanent DOS when DL NAS transport receives multiple payloads such that one payload contains SOR container whose integrity check has failed, and the other is LPP where UE needs…

Buffer Over-read in Video

Information disclosure while opening a fastrpc session when domain is not sanitized

Buffer Over-read in Video

Transient DOS in Core when DDR memory check is called while DDR is not initialized