** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none.
Memory corruption due to buffer copy without checking the size of input in modem while decoding raw SMS received.
Memory corruption due to integer overflow or wraparound in Core while DDR memory assignment.
Transient DOS due to time-of-check time-of-use race condition in Modem while processing RRC Reconfiguration message.
Memory corruption in Automotive Multimedia due to integer overflow to buffer overflow during IOCTL calls in video playback.
Information disclosure in Modem due to buffer over-read while getting length of Unfragmented headers in an IPv6 packet.
Memory corruption due to buffer copy without checking the size of input in Core while sending SCM command to get write protection information.
Memory corruption occurs in Modem due to improper validation of array index when malformed APDU is sent from card.
Information disclosure in Modem due to buffer over-read while receiving a IP header with malformed length.
Transient DOS in Modem due to NULL pointer dereference while receiving response of lwm2m registration/update/bootstrap request message.