qualcomm / wcd9370 CVEs

Information Disclosure when processing advertisement frames with malformed MBSSID elements of insufficient length.

Transient DOS when processing a malformed Fast Transition response frame with an invalid header structure during wireless roaming.

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver.

Memory corruption while preprocessing IOCTL request in JPEG driver.

Memory corruption while processing a video session to set video parameters.

Memory corruption while accessing a buffer during IOCTL processing.

Memory corruption while processing user buffers.

Memory corruption when programming registers through virtual CDM.

Memory corruption while processing the TESTPATTERNCONFIG escape path.

Memory corruption while processing image encoding, when input buffer length is 0 in IOCTL call.

Memory corruption while processing IPA statistics, when there are no active clients registered.

Memory corruption while IOCLT is called when device is in invalid state and the WMI command buffer may be freed twice.

Memory corruption while station LL statistic handling.

Memory corruption while processing user packets to generate page faults.

Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE.

Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame.

Memory corruption when a compat IOCTL call is followed by another IOCTL call from userspace to a driver.

Transient DOS while decoding message of size that exceeds the available system memory.

Forcing the Bluetooth LE stack to segment 'prepare write response' packets can lead to an out-of-bounds memory access.

Memory corruption in Qualcomm IPC due to use after free while receiving the incoming packet and reposting it.

Denial of service in Modem due to reachable assertion while processing SIB1 with invalid SCS and bandwidth settings in Snapdragon Mobile

Denial of service in MODEM due to reachable assertion while processing SIB1 with invalid Bandwidth in Snapdragon Mobile

Memory corruption in WLAN due to buffer copy without checking size of input while parsing keys in Snapdragon Connectivity, Snapdragon Mobile

Memory corruption in graphics due to use-after-free while graphics profiling in Snapdragon Connectivity, Snapdragon Mobile

Memory corruption in audio while playing record due to improper list handling in two threads in Snapdragon Connectivity, Snapdragon Mobile, Snapdragon Wearables