Memory Corruption when processing IOCTLs for JPEG data without verification.

Memory corruption while processing a malformed license file during reboot.

Memory corruption during PlayReady APP usecase while processing TA commands.

Memory corruption while encoding the image data.

Transient DOS while parsing the EPTM test control message to get the test pattern.

Memory corruption due to double free when multiple threads race to set the timestamp store.

memory corruption while loading a PIL authenticated VM, when authenticated VM image is loaded without maintaining cache coherency.

Cryptographic issue while performing RSA PKCS padding decoding.

Memory corruption while performing private key encryption in trusted application.

Memory corruption while processing simultaneous requests via escape path.

Memory corruption while processing IOCTL command with larger buffer in Bluetooth Host.

Transient DOS while processing an ANQP message.

Information disclosure while processing the hash segment in an MBN file.

Information disclosure while reading data from an image using specified offset and size parameters.

Memory corruption may occur while attaching VM when the HLOS retains access to VM.

Transient DOS may occur while parsing SSID in action frames.

Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver.

Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver.

Memory corruption may occur while reading board data via IOCTL call when the WLAN driver copies the content to the provided output buffer.

Memory corruption while IOCTL call is invoked from user-space to read board data.

Memory corruption occurs when handling client calls to EnableTestMode through an Escape call.

Memory corruption while processing escape code in API.

There may be information disclosure during memory re-allocation in TZ Secure OS.

Memory corruption while assigning memory from the source DDR memory(HLOS) to ADSP.

Memory corruption while taking snapshot when an offset variable is set by camera driver.

memory corruption when an invalid firehose patch command is invoked.

Cryptographic issue while parsing RSA keys in COBR format.

Information disclosure while decoding Tracking Area Update Accept or Attach Accept message received from network.

Transient DOS while decoding attach reject message received by UE, when IEI is set to ESM_IEI.

Memory corruption when preparing a shared memory notification for a memparcel in Resource Manager.