| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper. |
| Memory corruption in video while parsing invalid mp2 clip. |
| Memory corruption while validating the TID to Link Mapping action request frame, when a station connects to an access point. |
| Memory corruption in WLAN Host when the firmware invokes multiple WMI Service Available command. |
| Memory corruption while processing MBSSID beacon containing several subelement IE. |
| Memory corruption in Audio when memory map command is executed consecutively in ADSP. |
| Memory corruption while processing command in Glink linux. |
| Memory corruption in video while parsing the Videoinfo, when the size of atom is greater than the videoinfo size. |
| Memory corruption while processing concurrent IOCTL calls. |
| Transient DOS in Multi-Mode Call Processor due to UE failure because of heap leakage. |
| Memory corruption when BTFM client sends new messages over Slimbus to ADSP. |
| Transient DOS when importing a PKCS#8-encoded RSA private key with a zero-sized modulus. |
| Cryptographic issue while performing attach with a LTE network, a rogue base station can skip the authentication phase and immediately send the Security Mode Command. |
| Transient DOS while parsing the multi-link element Control field when common information length check is missing before updating the location. |
| Memory corruption while processing a QMI request for allocating memory from a DHMS supported subsystem. |
| Memory corruption while invoking IOCTLs calls in Automotive Multimedia. |
| Memory corruption while processing buffer initialization, when trusted report for certain report types are generated. |
| Transient DOS while parsing probe response and assoc response frame. |
| Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to address in the middle of ring element. |
| Memory corruption when HLOS allocates the response payload buffer to copy the data received from ADSP in response to AVCS_LOAD_MODULE command. |
