Qualcomm ≫ Csra6620 Firmware

Transient DOS due to NULL pointer dereference in Modem while sending invalid messages in DCCH.

Memory corruption due to integer overflow or wraparound in WLAN while sending WMI cmd from host to target.

Memory corruption due to improper validation of array index in User Identity Module when APN TLV length is greater than command length.

Information disclosure due to buffer over-read in Bluetooth Host while A2DP streaming.

Memory corruption occurs in Modem due to improper validation of array index when malformed APDU is sent from card.

Information disclosure in Modem due to buffer over-read while receiving a IP header with malformed length.

Information disclosure in Modem due to buffer over-read while getting length of Unfragmented headers in an IPv6 packet.

Memory corruption due to double free in core while initializing the encryption key.

Memory corruption due to buffer copy without checking the size of input in HLOS when input message size is larger than the buffer capacity.

Memory corruption in Video due to double free while playing 3gp clip with invalid metadata atoms.