Buffer Over-read in WLAN Embedded SW

Buffer Over-read in WLAN Host

Buffer Over-read in WLAN Host

Insufficient Granularity of Access Control in Core

Buffer Over-read in WLAN Firmware

Buffer Over-read in WLAN Host

Buffer Over-read in Multi Mode Call Processor

Buffer Over-read in Video

Improper Authentication in Multi-Mode Call Processor

Buffer Over-read in WLAN Firmware

Reachable Assertion in Data Modem

Transient DOS while processing multiple IKEV2 Informational Request to device from IPSEC server with different identifiers

Transient DOS while parse fils IE with length equal to 1

Transient DOS in WLAN Firmware when the length of received beacon is less than length of ieee802.11 beacon frame

Transient DOS while key unwrapping process, when the given encrypted key is empty or NULL

Transient DOS while parsing IPv6 extension header when WLAN firmware receives an IPv6 packet that contains `IPPROTO_NONE` as the next header

Transient DOS while processing a WMI P2P listen start command (0xD00A) sent from host

Transient DOS in WLAN Firmware while parsing a BTM request

Transient DOS in Data Modem during DTLS handshake

Transient DOS while parsing WPA IES, when it is passed with length more than expected size

Transient DOS when processing a NULL buffer while parsing WLAN vdev

Transient DOS while converting TWT (Target Wake Time) frame parameters in the OTA broadcast

Transient DOS while parsing a vender specific IE (Information Element) of reassociation response management frame

Transient DOS in Bluetooth Host while rfc slot allocation

Transient DOS in WLAN Firmware while parsing rsn ies

Cryptographic issue in Data Modem due to improper authentication during TLS handshake

Information Disclosure in data Modem while parsing an FMTP line in an SDP message

Information Disclosure in Data Modem while performing a VoLTE call with an undefined RTCP FB line value

Transient DOS in Modem while allocating DSM items

Transient DOS in WLAN Firmware while interpreting MBSSID IE of a received beacon frame

Transient DOS in WLAN Host when a mobile station receives invalid channel in CSA IE while doing channel switch announcement (CSA)

Information Disclosure in WLAN HOST while sending DPP action frame to peer with an invalid source address

Transient DOS in WLAN Firmware while processing frames with missing header fields

Transient DOS due to improper authorization in Modem

Transient DOS due to reachable assertion in Modem when UE received Downlink Data Indication message from the network

Transient DOS due to reachable assertion in Modem while processing config related to cross carrier scheduling, which is not supported

Information disclosure due to buffer over-read in Bluetooth Host while A2DP streaming

Transient DOS due to reachable assertion in Modem while processing SIB1 Message

Transient DOS in WLAN Firmware due to buffer over-read while processing probe response or beacon

Information disclosure due to buffer over-read in WLAN while parsing NMF frame

Transient DOS due to loop with unreachable exit condition in WLAN while processing an incoming FTM frames

Information disclosure due to buffer over-read in WLAN firmware while parsing security context info attributes

Denial of service in modem due to reachable assertion while processing reconfiguration message in Snapdragon Auto, Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon…

Denial of service in Modem module due to improper authorization while error handling in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT,…

Transient DOS due to loop with unreachable exit condition in WLAN firmware while parsing IPV6 extension header

Transient DOS due to buffer over-read in WLAN firmware while processing PPE threshold

Denial of service in WLAN due to potential null pointer dereference while accessing the memory location in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Transient Denial-of-Service in WLAN due to buffer over-read while parsing MDNS frames

Denial of service in WLAN due to out-of-bound read happens while processing VHT action frame in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…

Information disclosure in Bluetooth driver due to buffer over-read while reading l2cap length in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…