qualcomm / qca6595au_firmware CVEs

Memory Corruption when updating prepared commands with invalid port indices based on user space input exceeds supported read client limits.

Cryptographic Issue when using a static initialization vector for AES-GCM key wrapping, which requires a unique value for each call to ensure security.

Memory Corruption when processing display command line information due to improper initialization of a variable.

Transient DOS when MAC configures config id greater than supported maximum value.

Memory Corruption while processing IOCTL calls when concurrent access to shared buffer occurs.

Memory corruption while calculating offset from partition start point.

Memory corruption when calculating oversized partition sizes without proper checks.

Memory Corruption when a corrupted ELF image with an oversized file size is read into a buffer without authentication.

Memory corruption while processing large input data from a remote source via a communication interface.

Information disclosure while processing message from client with invalid payload.

Memory corruption when triggering a subsystem crash with an out-of-range identifier.

Memory corruption while processing client message during device management.

Information Disclosure when a user-level driver performs QFPROM read or write operations on Fuse regions.

Memory corruption while processing control commands in the virtual memory management interface.

Transient DOS while processing video packets received from video firmware.

Memory corruption while handling invalid inputs in application info setup.

Transient DOS while parsing the EPTM test control message to get the test pattern.

Memory corruption while handling repeated memory unmap requests from guest VM.

Memory corruption while processing data sent by FE driver.

Memory corruption while processing message in guest VM.

Memory corruption while selecting the PLMN from SOR failed list.

Information disclosure while decoding this RTP packet headers received by UE from the network when the padding bit is set.

Information disclosure while processing a packet at EAVB BE side with invalid header length.

Transient DOS while processing CCCH data when NW sends data with invalid length.

Memory corruption while copying the result to the transmission queue which is shared between the virtual machine and the host.