Use After Free in DSP Services

Improper Input Validation in WIN SON

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN Host

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN Host

Buffer Copy without Checking Size of Input in WLAN Firmware

Memory corruption due to buffer copy without checking the size of input in WLAN Firmware while processing CCKM IE in reassoc response frame

Memory corruption due to stack based buffer overflow in WLAN having invalid WNM frame length

Memory corruption in WLAN due to integer overflow to buffer overflow while parsing GTK frames

An out of bound memory access can occur due to improper validation of number of frames being passed during music playback in Snapdragon Auto, Snapdragon Compute, Snapdragon…

A use after free can occur due to improper validation of P2P device address in PD Request frame in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Possible buffer overflow due to improper validation of device types during P2P search in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…

Possible buffer overflow due to lack of parameter length check during MBSSID scan IE parse in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile,…

u'Remote code execution can happen by sending a carefully crafted POST query when Device configuration is accessed from a tethered client through webserver due to lack of array…

u'fscanf reads a string from a file and stores its contents on a statically allocated stack memory which leads to stack overflow' in Snapdragon Wired Infrastructure and Networking…

u'In the lbd service, an external user can issue a specially crafted debug command to overwrite arbitrary files with arbitrary content resulting in remote code execution.' in…

In Android before 2018-04-05 or earlier security patch level on Qualcomm Small Cell SoC, Snapdragon Mobile, and Snapdragon Wear FSM9055, IPQ4019, IPQ8064, MDM9206, MDM9607,…

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear IPQ4019, IPQ8064, MDM9206, MDM9607, MDM9640, MDM9650, QCA4531,…

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear IPQ4019, IPQ8064, MDM9206, MDM9607,…

Possible out of bound read due to improper validation of IE length during SSID IE parse when channel is DFS in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Possible buffer over read due to lack of length check while parsing beacon IE response in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…

Buffer over-read can happen while processing WPA,RSN IE of beacon and response frames if IE length is less than length of frame pointer being accessed in Snapdragon Auto,…

Possible out of bound read while WLAN frame parsing due to lack of check for body and header length in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Possible buffer over read while processing P2P IE and NOA attribute of beacon and probe response frames due to improper validation of P2P IE and NOA attribute lengths in…

Possible buffer over-read while parsing quiet IE in Rx beacon frame due to improper check of IE length in received beacon in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Out of bound memory access can happen while parsing ADSP message due to lack of check of size of payload received from userspace in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Out of bound access due to Invalid inputs to dapm mux settings which results into kernel failure in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon…

Possible memory corruption while processing EAPOL frames due to lack of validation of key length before using it in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Missing Authentication for Critical Function in Boot

Use After Free in HLOS

Buffer Over-read in MProc

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Qualcomm IPC

Improper Input Validation in Services

NULL pointer dereference in WLAN Firmware

Buffer Copy Without Checking Size of Input in WLAN Host

Improper Validation of Array Index in WLAN HAL

Improper Validation of Array Index in WLAN HAL

Improper Validation of Array Index in WLAN HAL

Use of Out-of-range Pointer Offset in WLAN HAL

Buffer Copy Without Checking Size of Input in WLAN HAL

Buffer Copy Without Checking Size of Input in WLAN HAL

Improper Validation of Array Index in WLAN HAL

Improper Validation of Array Index in WLAN HAL

Improper Restriction of Operations within the Bounds of a Memory Buffer in WLAN HAL

Improper Validation of Array Index in WLAN HAL

Buffer Copy without Checking the Size of Input in WLAN Firmware

Improper validation of array index in WLAN HAL

Memory Corruption in Data Modem while processing DMA buffer release event about CFR data

Arbitrary memory overwrite when VM gets compromised in TX write leading to Memory Corruption

Memory corruption in WLAN HAL while processing WMI-UTF command or FTM TLV1 command

Memory corruption due to integer overflow or wraparound in WLAN while sending WMI cmd from host to target