Memory corruption in bluetooth due to integer overflow while processing HFP-UNIT profile in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Mobile, Snapdragon Voice & Music

Memory corruption in bluetooth host due to integer overflow while processing BT HFP-UNIT profile in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon…

Memory corruption due to access of uninitialized pointer in Bluetooth HOST while processing the AVRCP packet

Information disclosure may occur while decoding the RTP packet with invalid header extension from network

Information disclosure may occur while decoding the RTP packet with improper header length for number of contributing sources

Information disclosure may occur during a video call if a device resets due to a non-conforming RTCP packet that doesn`t adhere to RFC standards

Out-of-bounds Write in Audio

Use After Free in Video

Out-of-bounds Write in DSP Service

Use After Free in Camera Driver

Use After Free in BTHOST

Use After Free in NPU

Memory corruption during dynamic process creation call when client is only passing address and length of shell binary

Memory corruption may occur during IO configuration processing when the IO port count is invalid

Memory corruption during concurrent access to server info object due to incorrect reference count update

Memory corruption occurs during the copying of read data from the EEPROM because the IO configuration is exposed as shared memory

Memory corruption while handling multuple IOCTL calls from userspace for remote invocation

Memory corruption while processing GPU page table switch

Memory corruption while processing voice packet with arbitrary data received from ADSP

Memory corruption while handling session errors from firmware

Use After Free in Qualcomm IPC

Memory corruption when IPv6 prefix timer object`s lifetime expires which are created while Netmgr daemon gets an IPv6 address

Memory corruption in WLAN Host while setting the PMK length in PMK length in internal cache

Memory Corruption in WLAN Host while deserializing the input PMK bytes without checking the input PMK length

Memory Corruption in camera while installing a fd for a particular DMA buffer

Memory Corruption in Radio Interface Layer while sending an SMS or writing an SMS to SIM

Memory Corruption while accessing metadata in Display

Memory corruption in Audio while validating and mapping metadata

Memory corruption in Audio during playback session with audio effects enabled

Memory corruption in RIL due to Integer Overflow while triggering qcril_uim_request_apdu request

Memory Corruption due to improper validation of array index in Linux while updating adn record

Memory corruption due to buffer over-read in Modem while processing SetNativeHandle RTP service

In the function call related to CAM_REQ_MGR_RELEASE_BUF there is no check if the buffer is being used

The cam_get_device_priv function does not check the type of handle being returned (device/session/link)

Memory Corruption in GPS HLOS Driver when injectFdclData receives data with invalid data length

Memory corruption in WLAN while running doDriverCmd for an unspecific command

Memory corruption in RIL while trying to send apdu packet

Memory corruption in Trusted Execution Environment while calling service API with invalid address

Memory corruption in Linux while calling system configuration APIs

Memory Corruption in Data Network Stack & Connectivity when sim gets detected on telephony

Memory corruption in Linux while sending DRM request

Memory corruption due to use after free in Core when multiple DCI clients register and deregister

Memory corruption in FM Host due to buffer copy without checking the size of input in FM Host

Memory corruption due to buffer copy without checking the size of input in Core while processing ioctl commands from diag client applications

Memory corruption in core due to buffer copy without check9ing the size of input while processing ioctl queries

Memory corruption due to stack based buffer overflow in core while sending command from USB of large size

Memory corruption in video driver due to type confusion error during video playback

Memory corruption in display due to double free while allocating frame buffer memory

Memory corruption in display driver due to incorrect type casting while accessing the fence structure fields

Memory corruption in camera due to buffer copy without checking size of input in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Mobile, Snapdragon…