Transient DOS in WLAN Host while doing channel switch announcement (CSA), when a mobile station receives invalid channel in CSA IE.
Transient DOS while processing TIM IE from beacon frame as there is no check for IE length.
A race condition exists in a driver potentially leading to a use-after-free condition.
Information disclosure due to buffer over-read in Modem while parsing DNS hostname.
Transient DOS due to NULL pointer dereference in Modem while performing pullup for received TCP/UDP packet.
Information disclosure in Modem due to buffer over-read while getting length of Unfragmented headers in an IPv6 packet.
Information disclosure in Modem due to buffer over-read while receiving a IP header with malformed length.
Transient DOS in WLAN Host when an invalid channel (like channel out of range) is received in STA during CSA IE.