| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Transient DOS while parsing the multi-link element Control field when common information length check is missing before updating the location. |
| Information Disclosure in data Modem while parsing an FMTP line in an SDP message. |
| Memory Corruption in WLAN HOST while parsing QMI response message from firmware. |
| Memory corruption while verifying the serialized header when the key pairs are generated. |
| Memory corruption while processing buffer initialization, when trusted report for certain report types are generated. |
| Information disclosure when the ADSP payload size received in HLOS in response to Audio Stream Manager matrix session is less than this expected size. |
| Information Disclosure in Data Modem while performing a VoLTE call with an undefined RTCP FB line value. |
| Information disclosure while invoking callback function of sound model driver from ADSP for every valid opcode received from sound model driver. |
| Memory corruption while processing Listen Sound Model client payload buffer when there is a request for Listen Sound session get parameter from ST HAL. |
| Transient DOS in WLAN Firmware when the length of received beacon is less than length of ieee802.11 beacon frame. |
| Memory corruption while validating the TID to Link Mapping action request frame, when a station connects to an access point. |
| Information disclosure when VI calibration state set by ADSP is greater than MAX_FBSP_STATE in the response payload to AFE calibration command. |
| Memory corruption when BTFM client sends new messages over Slimbus to ADSP. |
| Transient DOS may occur while processing the country IE. |
| Transient DOS while processing multiple payload container type with incorrect container length received in DL NAS transport OTA in NR. |
| Memory Corruption in WLAN HOST while processing WLAN FW request to allocate memory. |
| Memory corruption while operating the mailbox in Automotive. |
| Memory corruption while running NPU, when NETWORK_UNLOAD and (NETWORK_UNLOAD or NETWORK_EXECUTE_V2) commands are submitted at the same time. |
| Memory corruption when AP includes TID to link mapping IE in the beacons and STA is parsing the beacon TID to link mapping IE. |
| Transient DOS while parsing IPv6 extension header when WLAN firmware receives an IPv6 packet that contains `IPPROTO_NONE` as the next header. |
