qualcomm / qca6574au_firmware CVEs

Memory Corruption when processing display command line information due to improper initialization of a variable.

Memory Corruption while processing IOCTL calls when concurrent access to shared buffer occurs.

Memory corruption while calculating offset from partition start point.

Memory corruption when calculating oversized partition sizes without proper checks.

Memory corruption while processing large input data from a remote source via a communication interface.

Information disclosure while processing message from client with invalid payload.

Memory corruption when triggering a subsystem crash with an out-of-range identifier.

Memory corruption while processing client message during device management.

Memory corruption while processing control commands in the virtual memory management interface.

Transient DOS while processing video packets received from video firmware.

Memory corruption while handling invalid inputs in application info setup.

Memory corruption while handling repeated memory unmap requests from guest VM.

Memory corruption while processing data sent by FE driver.

Memory corruption while processing message in guest VM.

Memory corruption while processing config_dev IOCTL when camera kernel driver drops its reference to CPU buffers.

information disclosure while invoking calibration data from user space to update firmware size.

Information disclosure while decoding this RTP packet headers received by UE from the network when the padding bit is set.

Information disclosure while processing a packet at EAVB BE side with invalid header length.

Memory corruption while processing commands from A2dp sink command queue.

Memory corruption while processing IOCTL command when multiple threads are called to map/unmap buffer concurrently.

Memory corruption while copying the result to the transmission queue which is shared between the virtual machine and the host.

Memory corruption while copying the result to the transmission queue in EMAC.

Transient DOS while processing the EHT operation IE in the received beacon frame.

Memory corruption while processing a message, when the buffer is controlled by a Guest VM, the value can be changed continuously.

Transient DOS while processing of a registration acceptance OTA due to incorrect ciphering key data IE.