Qualcomm ≫ Mdm9645 Firmware

Transient DOS while processing TIM IE from beacon frame as there is no check for IE length.

Transient DOS while parsing IPv6 extension header when WLAN firmware receives an IPv6 packet that contains `IPPROTO_NONE` as the next header.

Transient DOS while parsing a vender specific IE (Information Element) of reassociation response management frame.

Memory corruption in WLAN HAL while handling command streams through WMI interfaces.

Memory corruption in WLAN HAL while processing WMI-UTF command or FTM TLV1 command.

Memory corruption due to integer overflow or wraparound in WLAN while sending WMI cmd from host to target.

Transient DOS in WLAN Firmware due to buffer over-read while processing probe response or beacon.

Transient DOS due to buffer over-read in WLAN while parsing WLAN CSA action frames.

Transient DOS due to buffer over-read in WLAN while processing 802.11 management frames.

Memory corruption in Core due to improper configuration in boot remapper.