qualcomm / qcm6490_firmware CVEs

Memory Corruption when processing multiple IOCTL calls with the same buffer file descriptor input.

Memory Corruption when processing multiple IOCTL calls with the same buffer file descriptor input due to accessing already freed memory.

Memory Corruption when invoking device input/output control operations for mapping and unmapping persistent memory buffers due to improper synchronization.

Memory corruption while using Strongbox due to buffer overflow.

Memory corruption while using Strongbox due to missing bounds check.

Memory Corruption when accessing shared buffers without validation of concurrent user-mode input modifications.

Memory corruption while processing multiple IOCTL command for escape operations.

Memory Corruption when output buffer size is smaller than input buffer size during data copying operation.

Memory corruption in windows drivers while sending incorrect trusted application request

Memory corruption when dynamically changing the size of a previously allocated buffer while its contents are being modified.

Memory corruption while preprocessing IOCTL request in JPEG driver.

Transient DOS when MAC configures config id greater than supported maximum value.

Memory corruption while processing a video session to set video parameters.

Memory corruption while accessing a synchronization object during concurrent operations.

Memory corruption while parsing clock configuration data for a specific hardware type.

Information disclosure while processing a firmware event.

Memory Corruption when processing IOCTLs for JPEG data without verification.

Memory corruption while accessing a buffer during IOCTL processing.

memory corruption while processing an image encoding completion event.

Transient DOS while processing IOCTL call for image encoding.

Memory corruption while encoding the image data.

Information disclosure when Video engine escape input data is less than expected minimum size.

Information disclosure while running video usecase having rogue firmware.

Memory corruption while processing simultaneous requests via escape path.

Memory corruption while processing IOCTL command with larger buffer in Bluetooth Host.