qualcomm / wcn6740_firmware CVEs

Memory corruption while processing IPA statistics, when there are no active clients registered.

Possible out of bound access in audio module due to lack of validation of user provided input.

Memory corruption while processing voice packet with arbitrary data received from ADSP.

Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon.

Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero.

Memory corruption during session sign renewal request calls in HLOS.

Transient DOS while decoding attach reject message received by UE, when IEI is set to ESM_IEI.

Transient DOS when NAS receives ODAC criteria of length 1 and type 1 in registration accept OTA.

Transient DOS during music playback of ALAC content.