Buffer Over-read in Multi Mode Call Processor

Out-of-bounds Write in Audio

Incorrect Calculation of Buffer Size in HLOS

Buffer Over-read in MProc

Use After Free in Video

Improper Access Control in Core.

Buffer Copy Without Checking Size of Input in Graphics Linux

Integer Overflow to Buffer Overflow in Audio

Use After Free in Kernel

Use of Out-of-range Pointer Offset in Audio

Buffer Copy Without Checking Size of Input in Audio

Buffer Copy Without Checking Size of Input in Audio

Use of Out-of-range Pointer Offset in Audio

Use After Free in Audio

Use of Out-of-range Pointer Offset in Audio

Buffer Copy without Checking Size of Input in HLOS

Integer Overflow to Buffer Overflow in User Identity Module

Buffer Copy Without Checking Size of Input in Boot

Improper Restriction of Operations within the Bounds of a Memory Buffer in UTILS

Improper Restriction of Operations within the Bounds of a Memory Buffer in MPP Performance

Buffer Copy Without Checking Size of Input in Audio

Memory corruption due to double free in Core while mapping HLOS address to the list

Memory corruption in Graphics while importing a file

Memory corruption due to improper validation of array index in User Identity Module when APN TLV length is greater than command length

Buffer Over-read in WLAN Embedded SW

Buffer Over-read in WLAN Host

Buffer Over-read in WLAN Host

Buffer Over-read in WLAN Firmware

Buffer Over-read in Multi Mode Call Processor

Improper Authentication in Multi-Mode Call Processor

Loop with Unreachable Exit Condition (Infinite Loop) in WLAN Firmware

Buffer over-read in WLAN Firmware

Buffer Over-read in Data Modem

Buffer Over-read in Data Modem

Transient DOS due to improper authorization in Modem

Information disclosure due to buffer over-read in Modem while parsing DNS hostname

Transient DOS due to NULL pointer dereference in Modem while performing pullup for received TCP/UDP packet

Information disclosure due to buffer over-read in Bluetooth Host while A2DP streaming

Information disclosure in Modem due to buffer over-read while receiving a IP header with malformed length

Information disclosure in Modem due to buffer over-read while getting length of Unfragmented headers in an IPv6 packet

Missing Cryptographic Step in Data Modem

Cryptographic Issues in Core

Use After Free in WLAN