qualcomm / qcs410 CVEs

information disclosure while invoking calibration data from user space to update firmware size.

Memory corruption while processing commands from A2dp sink command queue.

Memory corruption may occur during IO configuration processing when the IO port count is invalid.

Memory corruption occurs during the copying of read data from the EEPROM because the IO configuration is exposed as shared memory.

Information disclosure while parsing dts header atom in Video.

Transient DOS while decoding message of size that exceeds the available system memory.

Memory Corruption in WLAN Host while deserializing the input PMK bytes without checking the input PMK length.

Memory corruption while handling payloads from remote ESL.

Transient DOS in Bluetooth HOST while passing descriptor to validate the blacklisted BT keyboard.

In the function call related to CAM_REQ_MGR_RELEASE_BUF there is no check if the buffer is being used. So when a function called cam_mem_get_cpu_buf to get the kernel va to use, a…

The buffer obtained from kernel APIs such as cam_mem_get_cpu_buf() may be readable/writable in userspace after kernel accesses it. In other words, user mode may race and modify th…

Information disclosure in Bluetooth when an GATT packet is received due to improper input validation.

Memory corruption in Automotive Android OS due to improper validation of array index.

Memory corruption due to stack based buffer overflow in core while sending command from USB of large size.

Memory corruption in display driver due to incorrect type casting while accessing the fence structure fields

Memory corruption in camera due to buffer copy without checking size of input in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Mobile, Snapdragon Wearab…

Information disclosure in video due to buffer over-read while processing avi file in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IO…

Memory corruption in graphic driver due to use after free while calling multiple threads application to driver. in Snapdragon Consumer IOT

Memory corruption in graphics support layer due to use after free condition in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon W…

Improper size validation of QXDM commands can lead to memory corruption in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile

An integer overflow due to improper check performed after the address and size passed are aligned in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdrag…

Possible buffer overflow in Fastrpc while handling received parameters due to lack of validation on input parameters' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer I…

Buffer overflow/underflow occurs when typecasting the buffer passed by CPU internally in the library which is not aligned with the actual size of the structure' in Snapdragon Auto…

Arbitrary access to DSP memory due to improper check in loaded library for data received from CPU side' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon…

u'Integer overflow can cause a buffer overflow due to lack of table length check in the extensible boot Loader during the validation of security metadata while processing objects…