| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Transient DOS in Modem while triggering a camping on an 5G cell. |
| Memory corruption while processing Listen Sound Model client payload buffer when there is a request for Listen Sound session get parameter from ST HAL. |
| Cryptographic issue while performing attach with a LTE network, a rogue base station can skip the authentication phase and immediately send the Security Mode Command. |
| Transient DOS while parsing the received TID-to-link mapping element of beacon/probe response frame. |
| Memory corruption when the payload received from firmware is not as per the expected protocol size. |
| Memory corruption whhile handling the subsystem failure memory during the parsing of video packets received from the video firmware. |
| Weak Configuration due to improper input validation in Modem while processing LTE security mode command message received from network. |
| Memory corruption in Core Services while executing the command for removing a single event listener. |
| Memory Corruption in Core during syscall for Sectools Fuse comparison feature. |
| Memory corruption while processing pin reply in Bluetooth, when pin code received from APP layer is greater than expected size. |
| Memory Corruption in Data Modem while making a MO call or MT VOLTE call. |
| Memory Corruption in Modem due to double free while parsing the PKCS15 sim files. |
| Memory corruption in Audio while processing RT proxy port register driver. |
| Memory corruption while operating the mailbox in Automotive. |
| Memory corruption in video while parsing invalid mp2 clip. |
| Memory corruption while invoking IOCTLs calls from user space for internal mem MAP and internal mem UNMAP. |
| Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to address in the middle of ring element. |
| Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper. |
| Transient DOS while parsing a vender specific IE (Information Element) of reassociation response management frame. |
| Memory corruption during management frame processing due to mismatch in T2LM info element. |
