qualcomm / wcd9375 CVEs

Information Disclosure when processing advertisement frames with malformed MBSSID elements of insufficient length.

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver.

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver.

Memory corruption while preprocessing IOCTL request in JPEG driver.

Memory corruption while processing a video session to set video parameters.

Memory corruption while accessing a buffer during IOCTL processing.

Memory corruption while processing user buffers.

Memory corruption when programming registers through virtual CDM.

Memory corruption while IOCLT is called when device is in invalid state and the WMI command buffer may be freed twice.

Memory corruption while station LL statistic handling.

Memory corruption while handling IOCTL calls in JPEG Encoder driver.

Memory corruption while processing user packets to generate page faults.

Transient DOS while parsing probe response and assoc response frame.

Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE.

Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame.

Memory corruption when a compat IOCTL call is followed by another IOCTL call from userspace to a driver.

Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length.

Forcing the Bluetooth LE stack to segment 'prepare write response' packets can lead to an out-of-bounds memory access.

Memory corruption in Qualcomm IPC due to use after free while receiving the incoming packet and reposting it.

Denial of service in Modem due to reachable assertion while processing SIB1 with invalid SCS and bandwidth settings in Snapdragon Mobile

Denial of service in MODEM due to reachable assertion while processing SIB1 with invalid Bandwidth in Snapdragon Mobile

Memory corruption in WLAN due to buffer copy without checking size of input while parsing keys in Snapdragon Connectivity, Snapdragon Mobile

Memory corruption in graphics due to use-after-free while graphics profiling in Snapdragon Connectivity, Snapdragon Mobile

Memory corruption in audio while playing record due to improper list handling in two threads in Snapdragon Connectivity, Snapdragon Mobile, Snapdragon Wearables

Possible address manipulation from APP-NS while APP-S is configuring an RG where it tries to merge the address ranges in Snapdragon Connectivity, Snapdragon Mobile