Memory corruption in WLAN HAL while handling command through WMI interfaces.
Memory corruption in WLAN HAL while processing devIndex from untrusted WMI payload.
Memory corruption while processing audio effects.
Memory corruption in WLAN HOST while processing the WLAN scan descriptor list.
Memory corruption in WIN Product while invoking WinAcpi update driver in the UEFI region.
Memory corruption in TZ Secure OS while loading an app ELF.
Memory corruption in MPP performance while accessing DSM watermark using external memory address.
Memory corruption in WLAN FW while processing command parameters from untrusted WMI payload.
Memory corruption while allocating memory in COmxApeDec module in Audio.
Memory corruption in WLAN HAL while parsing WMI command parameters.
Lack of check to prevent the buffer length taking negative values can lead to stack overflow. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in IPQ8074, MDM9150, MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9650, MDM9655, MSM8909W, MSM8996AU, QCA6174A, QCA8081, QCS404, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, SDX20, Snapdragon_High_Med_2016, SXR1130
Memory Corruption in HLOS while registering for key provisioning notify.
Memory Corruption in Core due to secure memory access by user while loading modem image.
Memory Corruption in Audio while playing amrwbplus clips with modified content.
Memory corruption due to untrusted pointer dereference in automotive during system call.
Memory Corruption in Radio Interface Layer while sending an SMS or writing an SMS to SIM.
Memory Corruption in Core Platform while printing the response buffer in log.
Memory Corruption in Linux while processing QcRilRequestImsRegisterMultiIdentityMessage request.
Memory Corruption while accessing metadata in Display.
Memory corruption in Automotive GPU while querying a gsl memory node.
Memory corruption in Linux while calling system configuration APIs.
Memory corruption in WLAN while running doDriverCmd for an unspecific command.
Memory corruption when invalid input is passed to invoke GPU Headroom API call.
Memory Corruption in camera while installing a fd for a particular DMA buffer.
Memory corruption in RIL while trying to send apdu packet.
Memory Corruption in GPS HLOS Driver when injectFdclData receives data with invalid data length.
While processing the QCA_NL80211_VENDOR_SUBCMD_SET_TXPOWER_SCALE_DECR_DB vendor command, in which attribute QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE_DECR_DB contains fewer than 1 byte, in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-08-11 a buffer overrun occurs.
In Snapdragon (Automobile, Mobile, Wear) in version MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCA6574AU, QCA6584, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 820A, SDM429, SDM439, SDM630, SDM632, SDM636, SDM660, Snapdragon_High_Med_2016, lack of input validation in WLANWMI command handlers can lead to integer & heap overflows.
A stack-based buffer overflow can occur in a firmware routine in Snapdragon Mobile, Snapdragon Wear in version MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 835, SD 845, SD 850, SDA660
Buffer overwrite in the WLAN host driver by leveraging a compromised WLAN FW
In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of check on input received to calculate the buffer length can lead to out of bound write to kernel stack.
In msm_ispif_config_stereo() in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-06-21, the parameter params->entries[i].vfe_intf comes from userspace without any bounds check which could potentially result in a kernel out-of-bounds write.
Memory corruption due to stack-based buffer overflow in Core
Memory corruption due to buffer copy without checking size of input in Audio while voice call with EVS vocoder.
Memory corruption in core due to stack-based buffer overflow
Memory corruption in Core due to stack-based buffer overflow.
Memory corruption while passing untrusted/corrupted pointers from DSP to EVA.
Memory corruption when input parameter validation for number of fences is missing for fence frame IOCTL calls,
Memory corruption due to buffer copy without checking the size of input in WLAN Firmware while processing CCKM IE in reassoc response frame.
Information disclosure due to buffer over-read in WLAN while parsing BTM action frame.
Information disclosure due to buffer over-read in Bluetooth HOST while processing GetFolderItems and GetItemAttribute Cmds from peer device.
Memory corruption in Automotive Android OS due to improper input validation.
Transient DOS due to buffer over-read in WLAN while parsing WLAN CSA action frames.
Memory corruption in Linux while sending DRM request.
Memory corruption due to information exposure in Powerline Communication Firmware while sending different MMEs from a single, unassociated device.
Information disclosure due to buffer over-read in WLAN while WLAN frame parsing due to missing frame length check.
Memory corruption due to configuration weakness in modem wile sending command to write protected files.
Memory corruption due to stack based buffer overflow in WLAN having invalid WNM frame length.
Memory corruption in modem due to stack based buffer overflow while parsing OTASP Key Generation Request Message.
Transient DOS due to buffer over-read in WLAN while processing 802.11 management frames.