Incorrect Calculation of Buffer Size in HLOS

Buffer Over-read in MProc

Use of Out-of-range Pointer Offset in Audio

Use of Out-of-range Pointer Offset in Audio

Buffer Copy without Checking Size of Input in HLOS

Integer Overflow to Buffer Overflow in User Identity Module

Buffer Copy Without Checking Size of Input in Boot

Improper Restriction of Operations within the Bounds of a Memory Buffer in UTILS

Improper Restriction of Operations within the Bounds of a Memory Buffer in MPP Performance

Memory corruption due to double free in Core while mapping HLOS address to the list

Memory corruption in modem due to stack based buffer overflow while parsing OTASP Key Generation Request Message

Memory corruption due to improper validation of array index in User Identity Module when APN TLV length is greater than command length

Buffer Over-read in Multi Mode Call Processor

Improper Authentication in Multi-Mode Call Processor

Buffer Over-read in Data Modem

Buffer Over-read in Data Modem

Transient DOS due to improper authorization in Modem

Information disclosure due to buffer over-read in Modem while parsing DNS hostname

Transient DOS due to NULL pointer dereference in Modem while performing pullup for received TCP/UDP packet

Information disclosure in Modem due to buffer over-read while receiving a IP header with malformed length

Information disclosure in Modem due to buffer over-read while getting length of Unfragmented headers in an IPv6 packet

Missing Cryptographic Step in Data Modem

Cryptographic Issues in Core