Qualcomm ≫ Ar6003 Firmware

Crafted Binder Request Causes Heap UAF in MediaServer

A race condition exists in a driver potentially leading to a use-after-free condition.

Cryptographic issue while performing attach with a LTE network, a rogue base station can skip the authentication phase and immediately send the Security Mode Command.

Memory corruption in Audio while processing RT proxy port register driver.

Memory corruption while using the UIM diag command to get the operators name.

Information Disclosure in data Modem while parsing an FMTP line in an SDP message.

Information Disclosure in Data Modem while performing a VoLTE call with an undefined RTCP FB line value.

Transient DOS due to improper authorization in Modem

Memory corruption in modem due to stack based buffer overflow while parsing OTASP Key Generation Request Message.

Memory corruption due to improper validation of array index in User Identity Module when APN TLV length is greater than command length.