Qualcomm ≫ Qcn7606 Firmware

Memory corruption in SPS Application while requesting for public key in sorter TA.

Memory corruption while processing finish_sign command to pass a rsp buffer.

Memory corruption while parsing qcp clip with invalid chunk data size.

Transient DOS while parse fils IE with length equal to 1.

Memory corruption in video while parsing invalid mp2 clip.

Memory corruption in video while parsing the Videoinfo, when the size of atom is greater than the videoinfo size.

Memory corruption in Core while processing control functions.

Transient DOS while parsing IPv6 extension header when WLAN firmware receives an IPv6 packet that contains `IPPROTO_NONE` as the next header.

Transient DOS while parsing GATT service data when the total amount of memory that is required by the multiple services is greater than the actual size of the services buffer.

Transient DOS while processing a WMI P2P listen start command (0xD00A) sent from host.