qualcomm / qca6574a_firmware CVEs

Memory Corruption when processing display command line information due to improper initialization of a variable.

Transient DOS when MAC configures config id greater than supported maximum value.

Memory Corruption while processing IOCTL calls when concurrent access to shared buffer occurs.

Memory corruption while processing control commands in the virtual memory management interface.

Memory corruption while handling invalid inputs in application info setup.

Memory corruption while selecting the PLMN from SOR failed list.

Information disclosure while decoding this RTP packet headers received by UE from the network when the padding bit is set.

Information disclosure while processing a packet at EAVB BE side with invalid header length.

Transient DOS while processing CCCH data when NW sends data with invalid length.

Transient DOS while processing the EHT operation IE in the received beacon frame.

Memory corruption while processing a message, when the buffer is controlled by a Guest VM, the value can be changed continuously.

Memory corruption while sound model registration for voice activation with audio kernel driver.

Memory corruption while processing message content in eAVB.

Memory corruption while processing memory map or unmap IOCTL operations simultaneously.

Transient DOS may occur while parsing extended IE in beacon.

Information disclosure may be there when a guest VM is connected.

Memory corruption while processing multiple IOCTL calls from HLOS to DSP.

Memory corruption while accessing MSM channel map and mixer functions.

Memory corruption while processing input message passed from FE driver.

Memory corruption may occur while processing message from frontend during allocation.

Information disclosure may occur due to improper permission and access controls to Video Analytics engine.

Information disclosure during audio playback.

Memory corruption can occur if an already verified IFS2 image is overwritten, bypassing boot verification. This allows unauthorized programs to be injected into security-sensitive…

Transient DOS while parsing the MBSSID IE from the beacons when IE length is 0.

Transient DOS while parsing ESP IE from beacon/probe response frame.