Qualcomm : Security Vulnerabilities, CVEs, (Overflow) CVSS score >= 4

Memory corruption while validating the TID to Link Mapping action request frame, when a station connects to an access point.

Memory corruption in video while parsing the Videoinfo, when the size of atom is greater than the videoinfo size.

Memory corruption when resource manager sends the host kernel a reply message with multiple fragments.

Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.

Memory corruption while processing pin reply in Bluetooth, when pin code received from APP layer is greater than expected size.

Memory corruption in Core while processing RX intent request.

Memory corruption in wearables while processing data from AON.

Memory corruption in WLAN Host while processing RRM beacon on the AP.

Memory corruption while sending an Assoc Request having BTM Query or BTM Response containing MBO IE.

Memory corruption in Audio while running invalid audio recording from ADSP.

Memory corruption in HLOS while converting from authorization token to HIDL vector.

Memory corruption in Core while processing control functions.

Memory corruption in Audio while processing the calibration data returned from ACDB loader.

Memory corruption in Audio while processing IIR config data from AFE calibration block.

Memory Corruption in Audio while invoking callback function in driver from ADSP.

Memory corruption in WLAN Firmware while parsing a NAN management frame carrying a S3 attribute.

Memory corruption while receiving a message in Bus Socket Transport Server.

Memory corruption while invoking callback function of AFE from ADSP.

Memory corruption in TZ Secure OS while requesting a memory allocation from TA region.

Memory corruption in Automotive Audio while copying data from ADSP shared buffer to the VOC packet data buffer.

Memory corruption in HLOS while running playready use-case.

Memory corruption in Data Modem when a non-standard SDP body, during a VOLTE call.

Memory corruption while sending SMS from AP firmware.

Memory corruption in HLOS while invoking IOCTL calls from user-space.

Memory corruption while using the UIM diag command to get the operators name.