Qualcomm ≫ Mdm9650 Firmware

Memory corruption in WLAN due to use after free

Transient DOS in WLAN Firmware due to buffer over-read while processing probe response or beacon.

Memory corruption due to configuration weakness in modem wile sending command to write protected files.

Memory corruption in User Identity Module due to integer overflow to buffer overflow when a segement is received via qmi http.

Memory corruption due to access of uninitialized pointer in Bluetooth HOST while processing the AVRCP packet.

Memory corruption due to stack-based buffer overflow in Core

Memory corruption in Audio due to integer overflow to buffer overflow while music playback of clips like amr,evrc,qcelp with modified content.

Transient DOS due to buffer over-read in WLAN while parsing WLAN CSA action frames.

Transient DOS due to buffer over-read in WLAN while processing 802.11 management frames.

Transient DOS in Bluetooth HOST due to null pointer dereference when a mismatched argument is passed.