Memory corruption during PlayReady APP usecase while processing TA commands.

Memory corruption when the UE receives an RTP packet from the network, during the reassembly of NALUs.

memory corruption while loading a PIL authenticated VM, when authenticated VM image is loaded without maintaining cache coherency.

Information disclosure when UE receives the RTP packet from the network, while decoding and reassembling the fragments from RTP packet.

Information disclosure while decoding RTP packet received by UE from the network, when payload length mentioned is greater than the available buffer length.

Cryptographic issue while performing RSA PKCS padding decoding.

Transient DOS while processing an ANQP message.

Information disclosure while processing the hash segment in an MBN file.

Information disclosure while reading data from an image using specified offset and size parameters.

There may be information disclosure during memory re-allocation in TZ Secure OS.

Transient DOS while connecting STA to AP and initiating ADD TS request from AP to establish TSpec session.

Memory corruption while assigning memory from the source DDR memory(HLOS) to ADSP.

Information disclosure may occur during a video call if a device resets due to a non-conforming RTCP packet that doesnt adhere to RFC standards.

Memory corruption while handling file descriptor during listener registration/de-registration.

Memory corruption when allocating and accessing an entry in an SMEM partition continuously.

memory corruption when an invalid firehose patch command is invoked.

Transient DOS while parsing ESP IE from beacon/probe response frame.

Transient DOS while loading the TA ELF file.

Memory corruption when allocating and accessing an entry in an SMEM partition.

Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to address in the middle of ring element.

Memory corruption in Core while processing control functions.

Transient DOS while parse fils IE with length equal to 1.

Transient DOS while parsing IPv6 extension header when WLAN firmware receives an IPv6 packet that contains IPPROTONONE as the next header.

Transient DOS while processing a WMI P2P listen start command (0xD00A) sent from host.

Transient DOS in WLAN Firmware while parsing a BTM request.

Memory corruption in HLOS while running playready use-case.

Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE.

Memory corruption while loading an ELF segment in TEE Kernel.

Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.

Memory Corruption in SPS Application while exporting public key in sorter TA.