Qualcomm ≫ Snapdragon X75 5g Modem-rf Firmware

Information disclosure while invoking callback function of sound model driver from ADSP for every valid opcode received from sound model driver.

Memory corruption while processing IOCTL call for getting group info.

Transient DOS while processing an improperly formatted Fine Time Measurement (FTM) management frame.

Cryptographic issue while performing attach with a LTE network, a rogue base station can skip the authentication phase and immediately send the Security Mode Command.

Memory corruption when more scan frequency list or channels are sent from the user space.

Memory corruption when IPC callback handle is used after it has been released during register callback by another thread.

Memory corruption while copying a keyblob`s material when the key material`s size is not accurately checked.

Information disclosure while handling T2LM Action Frame in WLAN Host.

Memory corruption in TZ Secure OS while Tunnel Invoke Manager initialization.

Memory corruption while playing audio file having large-sized input buffer.