Seonung Jang

The issue is related to memory corruption in the diag component due to a use-after-free error while processing a DCI packet. This affects various Qualcomm Snapdragon products, including Auto, Compute, Consumer IOT, Industrial IOT, Mobile, Wearables, Wired Infrastructure, and Networking.

The issue is related to memory corruption due to use after free in a service. This occurs when trying to access maps by different threads, which can lead to instability or potentially allow for unauthorized access or control. The estimated number of potentially affected devices worldwide is not specified. There is no information available about real-world incidents where this issue was exploited.

The issue is related to information disclosure due to exposure of information while the GPU reads the data. This can be used to leak large amounts of information to a malicious Android application. The vulnerability can leak information in both the user space and kernel space level of pages. The GitHub Security Lab used the kernel space information leak to construct a KASLR bypass.

The issue is related to a use after free vulnerability in the `dsp context unload graph` function. This vulnerability allows attackers to perform malicious actions.

The issue is related to an information disclosure problem in the win32k component, which can improperly provide kernel information. This can allow an attacker to obtain sensitive information. The vulnerability is associated with errors in processing objects in memory.

The issue is related to errors in the implementation of cross-frame interaction in Microsoft browsers. It allows a remote attacker to disclose protected information using a specially crafted web page. An attacker who successfully exploits this issue could obtain browser frame or window state from a different domain.

An elevation of privilege issue exists in Microsoft browsers, allowing sandbox escape. This could enable an attacker to elevate privileges on an affected system. The vulnerability by itself does not allow arbitrary code execution but could be used in combination with another vulnerability to run arbitrary code.