qualcomm / qca6696_firmware CVEs

Memory corruption due to incorrect type conversion or cast in audio while using audio playback/capture when crafted address is sent from AGM IPC to AGM.

Memory corruption in Automotive Multimedia due to integer overflow to buffer overflow during IOCTL calls in video playback.

Transient DOS due to time-of-check time-of-use race condition in Modem while processing RRC Reconfiguration message.

Memory corruption in Automotive Android OS due to improper validation of array index.

Memory corruption due to stack based buffer overflow in core while sending command from USB of large size.

Memory corruption due to improper validation of array index in Multi-mode call processor.

Transient DOS due to reachable assertion in Modem while processing SIB1 Message.

Transient DOS due to reachable assertion in modem when network repeatedly sent invalid message container for NR to LTE handover.

Transient Denial-of-service in Automotive due to improper input validation while parsing ELF file.

Memory corruption in Automotive Android OS due to improper input validation.

Memory corruption in android core due to improper validation of array index while returning feature ids after license authentication.

Memory corruption in Automotive due to integer overflow to buffer overflow while registering a new listener with shared buffer.

Memory corruption in Automotive due to improper input validation.

Denial of service in MODEM due to improper pointer handling

Memory corruption in video driver due to type confusion error during video playback

Memory corruption in camera due to improper validation of array index in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile…

Denial of service in Modem due to reachable assertion while processing the common config procedure in Snapdragon Auto, Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mo…

Information disclosure in video due to buffer over-read while parsing avi files in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdra…

Memory corruption in display due to time-of-check time-of-use of metadata reserved size in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT,…

Memory corruption in automotive multimedia due to use of out-of-range pointer offset while parsing command request packet with a very large type value. in Snapdragon Auto

Memory corruption in display due to time-of-check time-of-use race condition during map or unmap in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Indust…

Possible integer overflow and memory corruption due to improper validation of buffer size sent to write to console when computing the payload size in Snapdragon Auto, Snapdragon C…

Memory corruption in multimedia due to improper check on the messages received. in Snapdragon Auto

Memory corruption in multimedia due to incorrect type conversion while adding data in Snapdragon Auto

Denial of service in multimedia due to uncontrolled resource consumption while parsing an incoming HAB message in Snapdragon Auto