qualcomm / qca6430 CVEs

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing.

Memory Corruption when multiple threads simultaneously access a memory free API.

Memory Corruption when processing IOCTLs for JPEG data without verification.

Memory corruption while encoding the image data.

Memory corruption due to double free when multiple threads race to set the timestamp store.

Memory corruption while processing simultaneous requests via escape path.

Memory corruption while processing IOCTL command with larger buffer in Bluetooth Host.

Memory corruption during the image encoding process.

Memory corruption while processing event close when client process terminates abruptly.

Memory corruption while processing multiple simultaneous escape calls.

Memory corruption while processing a private escape command in an event trigger.

Memory corruption while processing escape code, when DisplayId is passed with large unsigned value.

Memory corruption while processing image encoding, when configuration is NULL in IOCTL parameter.

Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver.

Memory corruption occurs when handling client calls to EnableTestMode through an Escape call.

Memory corruption while processing escape code in API.

Memory corruption while handling IOCTL call from user-space to set latency level.

Memory corruption while taking a snapshot with hardware encoder due to unvalidated userspace buffer.

Memory corruption while processing input parameters for any IOCTL call in the JPEG Encoder driver.

Memory corruption while processing IOCTL handler in FastRPC.

Information disclosure in Video while parsing mp2 clip with invalid section length.

Memory corruption while allocating memory for graphics.

Memory corruption while invoking the SubmitCommands call on Gfx engine during the graphics render.

Memory corruption while processing the IOCTL FM HCI WRITE request.

Memory corruption when IPv6 prefix timer object`s lifetime expires which are created while Netmgr daemon gets an IPv6 address.