qca8085_firmware

Memory corruption due to buffer copy without checking the size of input in WLAN Firmware while processing CCKM IE in reassoc response frame.

Memory corruption in WLAN Firmware while doing a memory copy of pmk cache.

Memory corruption in WLAN Firmware while parsing a NAN management frame carrying a S3 attribute.

Memory corruption while sending an Assoc Request having BTM Query or BTM Response containing MBO IE.

Memory corruption in WLAN Host while processing RRM beacon on the AP.

Memory corruption while processing MBSSID beacon containing several subelement IE.

Memory corruption while parsing beacon/probe response frame when AP sends more supported links in MLIE.

Memory corruption while redirecting log file to any file location with any file name.

Memory corruption while redirecting log file to any file location with any file name.

Memory corruption while parsing the ML IE due to invalid frame content.

Memory corruption due to double free in core while initializing the encryption key.

Memory corruption in TZ Secure OS while requesting a memory allocation from TA region.

Memory corruption in Core while processing control functions.

Memory corruption due to buffer copy without checking size of input in modem while receiving WMI_REQUEST_STATS_CMDID command.

Memory corruption in Core due to stack-based buffer overflow.

Memory corruption in core due to stack-based buffer overflow

Memory corruption in modem due to buffer copy without checking size of input while receiving WMI command.

Memory corruption in WLAN due to integer overflow to buffer overflow in WLAN during initialization phase.

Memory corruption in WLAN due to incorrect type cast while sending WMI_SCAN_SCH_PRIO_TBL_CMDID message.