Vulnerabilidades

On some hardware revisions where VP9 decoding is hardware-accelerated, the frame size is not programmed correctly into the decoder hardware which can lead to an invalid memory access by the decoder.

Transient DOS while parsing a vender specific IE (Information Element) of reassociation response management frame.

Transient DOS in Automotive OS due to improper authentication to the secure IO calls.

Memory corruption in DSP Services during a remote call from HLOS to DSP.

Cryptographic issue in GPS HLOS Driver while downloading Qualcomm GNSS assistance data.

Memory corruption while using the UIM diag command to get the operators name.

Memory corruption in Audio while processing the VOC packet data from ADSP.

Memory corruption in Automotive Audio while copying data from ADSP shared buffer to the VOC packet data buffer.

Memory corruption due to improper validation of array index in WLAN HAL when received lm_itemNum is out of range.

Memory Corruption in GPU Subsystem due to arbitrary command execution from GPU in privileged mode.

Transient DOS while parsing WLAN beacon or probe-response frame.

Transient DOS in WLAN Firmware while processing frames with missing header fields.

Memoru corruption in Audio when ADSP sends input during record use case.

Memory corruption in WLAN HAL while processing WMI-UTF command or FTM TLV1 command.

Transient DOS due to improper authorization in Modem

Memory corruption due to double free in Core while mapping HLOS address to the list.

Memory corruption in modem due to stack based buffer overflow while parsing OTASP Key Generation Request Message.

information disclosure due to cryptographic issue in Core during RPMB read request.

Transient DOS due to reachable assertion in Modem when UE received Downlink Data Indication message from the network.

Memory Corruption in Graphics while accessing a buffer allocated through the graphics pool.

Memory corruption in Graphics while importing a file.

Memory corruption due to integer overflow or wraparound in WLAN while sending WMI cmd from host to target.

Information disclosure due to buffer over-read in Bluetooth Host while A2DP streaming.

Memory corruption due to improper validation of array index in User Identity Module when APN TLV length is greater than command length.

Memory corruption occurs in Modem due to improper validation of array index when malformed APDU is sent from card.