Qualcomm

Memory corruption in WIN Product while invoking WinAcpi update driver in the UEFI region.

Memory corruption due to improper validation of array index in WLAN HAL when received lm_itemNum is out of range.

In wlan driver, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07441589; Issue ID: ALPS07441589.

In camera driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed

Memory corruption in QESL while processing payload from external ESL device to firmware.

Cryptographic issue in HLOS as derived keys used to encrypt/decrypt information is present on stack after use.

Memory Corruption in GPS HLOS Driver when injectFdclData receives data with invalid data length.

Memory Corruption in WLAN HOST while fetching TX status information.

Memory Corruption in WLAN HOST while parsing QMI response message from firmware.

Memory Corruption in Audio while allocating the ion buffer during the music playback.

In wlan firmware, there is possible system crash due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07664741; Issue ID: ALPS07664741.

Marval MSM through 14.19.0.12476 uses a static encryption key for secrets. An attacker that gains access to encrypted secrets can decrypt them by using this key.

Marval MSM through 14.19.0.12476 and 15.0 has a System account with default credentials. A remote attacker is able to login and create a valid session. This makes it possible to make backend calls to endpoints in the application.

Marval MSM through 14.19.0.12476 and 15.0 has a Remote Code Execution vulnerability. A remote attacker authenticated as any user is able to execute code in context of the web server.

Memory Corruption in GPU Subsystem due to arbitrary command execution from GPU in privileged mode.

Information Disclosure in WLAN HOST while sending DPP action frame to peer with an invalid source address.

Memory corruption in Automotive GPU while querying a gsl memory node.

Information disclosure in Linux Networking Firmware due to unauthorized information leak during side channel analysis.

Memory corruption in FM Host due to buffer copy without checking the size of input in FM Host

Information disclosure due to buffer over-read in Trusted Execution Environment while QRKS report generation.

Memory Corruption in Graphics while accessing a buffer allocated through the graphics pool.

Memory corruption in Qualcomm IPC due to use after free while receiving the incoming packet and reposting it.

Memory corruption due to incorrect type conversion or cast in audio while using audio playback/capture when crafted address is sent from AGM IPC to AGM.

Memory corruption in Automotive Multimedia due to integer overflow to buffer overflow during IOCTL calls in video playback.

Memory corruption in Bluetooth HOST while processing the AVRC_PDU_GET_PLAYER_APP_VALUE_TEXT AVRCP response.

Transient DOS due to buffer over-read in WLAN Firmware while parsing secure FTMR frame with size lesser than 39 Bytes.

Memory corruption due to buffer copy without checking the size of input in HLOS when input message size is larger than the buffer capacity.

Memory corruption due to improper validation of array index in Multi-mode call processor.

Memory corruption due to improper authentication in Qualcomm IPC while loading unsigned lib in audio PD.

Memory corruption in WLAN HAL while arbitrary value is passed in WMI UTF command payload.

In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.

Memory corruption due to buffer copy without checking the size of input in WLAN Firmware while processing CCKM IE in reassoc response frame.

Transient DOS in WLAN Firmware due to buffer over-read while processing probe response or beacon.

Memory corruption in User Identity Module due to integer overflow to buffer overflow when a segement is received via qmi http.

Memory corruption in Audio due to use of out-of-range pointer offset while Initiating a voice call session from user space with invalid session id.

In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.

In wlan driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in wlan services.

In wlan driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in wlan services.

In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.

In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.

In wlan driver, there is a race condition. This could lead to local denial of service in wlan services.

Transient DOS due to null pointer dereference in Bluetooth HOST while receiving an attribute protocol PDU with zero length data.

Memory corruption due to information exposure in Powerline Communication Firmware while sending different MMEs from a single, unassociated device.

Memory corruption in kernel due to missing checks when updating the access rights of a memextent mapping.

Denial of service while processing fastboot flash command on mmc due to buffer over read

Denial of service in MODEM due to reachable assertion while processing configuration from network in Snapdragon Mobile

Information disclosure due to buffer over-read in Bluetooth HOST while pairing and connecting A2DP. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Possible memory corruption in kernel while performing memory access due to hypervisor not correctly invalidated the processor translation caches in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile

Information disclosure due to buffer over-read in WLAN firmware while parsing security context info attributes. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT,…

Denial of service in Modem due to reachable assertion while processing SIB1 with invalid SCS and bandwidth settings in Snapdragon Mobile