Qualcomm ≫ Wcd9335 Firmware

Information disclosure while deriving keys for a session for any Widevine use case.

Memory corruption while power-up or power-down sequence of the camera sensor.

Information disclosure while parsing the OCI IE with invalid length.

Memory corruption can occur when a compat IOCTL call is followed by a normal IOCTL call from userspace.

Information disclosure while invoking callback function of sound model driver from ADSP for every valid opcode received from sound model driver.

Memory corruption while processing API calls to NPU with invalid input.

Memory corruption when allocating and accessing an entry in an SMEM partition continuously.

Transient DOS while parsing the ML IE when a beacon with common info length of the ML IE greater than the ML IE inside which this element is present.

Memory corruption when invalid input is passed to invoke GPU Headroom API call.

Possible out of bound access in audio module due to lack of validation of user provided input.