qualcomm / qca6696 CVEs

Cryptographic Issue when using a static initialization vector for AES-GCM key wrapping, which requires a unique value for each call to ensure security.

Memory Corruption when processing display command line information due to improper initialization of a variable.

Transient DOS when MAC configures config id greater than supported maximum value.

Memory Corruption while processing IOCTL calls when concurrent access to shared buffer occurs.

Memory corruption while calculating offset from partition start point.

Memory corruption when calculating oversized partition sizes without proper checks.

Transient DOS while parsing video packets received from the video firmware.

Memory Corruption when a corrupted ELF image with an oversized file size is read into a buffer without authentication.

Memory corruption while processing large input data from a remote source via a communication interface.

Memory corruption when triggering a subsystem crash with an out-of-range identifier.

Memory corruption while processing client message during device management.

Information Disclosure when a user-level driver performs QFPROM read or write operations on Fuse regions.

Transient DOS while processing video packets received from video firmware.

Memory corruption while handling invalid inputs in application info setup.

Transient DOS while parsing the EPTM test control message to get the test pattern.

Memory corruption while handling repeated memory unmap requests from guest VM.

Memory corruption while processing data sent by FE driver.

Memory corruption while processing message in guest VM.

Memory corruption while processing config_dev IOCTL when camera kernel driver drops its reference to CPU buffers.

Memory corruption while selecting the PLMN from SOR failed list.

information disclosure while invoking calibration data from user space to update firmware size.

Transient DOS while processing CCCH data when NW sends data with invalid length.

Memory corruption while processing commands from A2dp sink command queue.

Memory corruption while processing IOCTL command when multiple threads are called to map/unmap buffer concurrently.

Memory corruption while copying the result to the transmission queue which is shared between the virtual machine and the host.