qualcomm / ipq6000_firmware CVEs

Memory corruption while deinitializing a HDCP session.

Transient DOS while creating NDP instance.

Transient DOS may occur when processing vendor-specific information elements while parsing a WLAN frame for BTM requests.

Memory corruption during the secure boot process, when the `bootm` command is used, it bypasses the authentication of the kernel/rootfs image.

Memory corruption in TZ Secure OS while requesting a memory allocation from TA region.

Transient DOS in WLAN firmware while parsing MLO (multi-link operation).

Transient DOS in WLAN Firmware while parsing FT Information Elements.

Information disclosure in Linux Networking Firmware due to unauthorized information leak during side channel analysis.

Memory corruption in Linux Networking due to double free while handling a hyp-assign.

Transient DOS due to reachable assertion in WLAN while processing PEER ID populated by TQM.

Transient DOS due to buffer over-read in WLAN Firmware while parsing secure FTMR frame with size lesser than 39 Bytes.

Memory corruption due to buffer copy without checking the size of input in WLAN Firmware while processing CCKM IE in reassoc response frame.

Transient DOS due to uncontrolled resource consumption in WLAN firmware when peer is freed in non qos state.

Transient DOS due to improper input validation in WLAN Host.

Transient DOS due to improper input validation in WLAN Host while parsing frame during defragmentation.

Transient DOS due to buffer over-read in WLAN Host while parsing frame information.

Transient DOS due to buffer over-read in WLAN while processing an incoming management frame with incorrectly filled IEs.

Memory corruption due to stack based buffer overflow in WLAN having invalid WNM frame length.

Information disclosure due to buffer over-read in WLAN while parsing NMF frame.

Information disclosure due to buffer overread in Core

Memory corruption in core due to stack-based buffer overflow

Memory corruption in Core due to stack-based buffer overflow.

Information disclosure due to buffer over-read in WLAN while parsing BTM action frame.

Information disclosure due to buffer over-read in WLAN while WLAN frame parsing due to missing frame length check.

Memory corruption due to buffer copy without checking size of input in modem while receiving WMI_REQUEST_STATS_CMDID command.