CVE-2017-15859

While processing the QCANL80211VENDORSUBCMDSETTXPOWERSCALEDECRDB vendor command, in which attribute QCAWLANVENDORATTRTXPOWERSCALEDECRDB contains fewer than 1 byte, in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-08-11 a buffer overrun occurs...

CVE-2017-17766

In wmapeerinfoeventhandler in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-10-03, the value of numpeers received from firmware is not properly validated so that an integer overflow vulnerability in the size of a buffer allocation may potentially lead to a buffer overflow...

CVE-2018-3561

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a race condition in diagioctllsmdeinit leads to a Use After Free condition...

Out-of-bounds

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in msmflashsubdevdoioctl of drivers/media/platform/msm/camerav2/sensor/flash/msmflash.c, there is a possible out of bounds read if flashdata.cfgtype is CFGFLASHINIT due to improper inpu...

CVE-2018-3561

CVE-2018-3561 is a Qualcomm Diagchar-related issue affecting Android on MSM devices. The root cause is a race condition in diag_ioctl_lsm_deinit() that leads to a Use-After-Free condition. The vulnerability is characterized as Elevation of Privilege (EoP) with local access requirements and high i...

CVE-2017-11082: Improper Restriction of Operations within the Bounds of a Memory Buffer

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, due to a race condition in a firmware loading routine, a buffer overflow could potentially occur if multiple user space threads try to update the WLAN firmware file through sysfs...

CVE-2017-18068

CVE-2017-18068 involves an improper buffer length calculation in wma_roam_scan_filter() that can cause a buffer overflow. Affected are Android for MSM, Firefox OS for MSM, and QRD Android builds using CAF with the Linux kernel. The issue is classified as EoP/High-impact (CVSS v3.0: 7.8) with loca...

Buffer overflow

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while calculating CRC for GPT header fields with partition entries greater than 16384 buffer overflow occurs...

CVE-2017-9689

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a specially-crafted HDMI CEC message can be used to cause stack memory corruption...

UBUNTU-CVE-2017-15847

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the SPCom kernel driver, a race condition exists when creating a channel...

CVE-2017-11069

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, manipulation of SafeSwitch Image data can result in Heap overflow...

CVE-2017-15845: Improper Input Validation

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, an invalid input of firmware size negative value from user space can potentially lead to the memory leak or buffer overflow during the WLAN cal data store operation...

Race condition

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, due to a race condition in the GLink kernel driver, a Use After Free condition can potentially occur...

CVE-2017-9718

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a race condition in a multimedia driver can potentially lead to a buffer overwrite...

CVE-2017-9722

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, when updating custom EDID hdmitxsysfswtaedid, if edidsize, which is controlled by userspace, is too large, a buffer overflow occurs...

CVE-2017-11006: Use After Free

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a Use After Free condition can occur during positioning...

CVE-2017-14907: Undefined Security Weakness

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, cryptographic strength is reduced while deriving disk encryption key...

CVE-2017-14900: Improper Restriction of Operations within the Bounds of a Memory Buffer

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing the QCANL80211VENDORSUBCMDGETCHAINRSSI vendor command, in which attribute QCAWLANVENDORATTRMACADDR contains fewer than 6 bytes, a buffer overrun occurs...

CVE-2017-11015

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, currently, the value of SIRMACAUTHCHALLENGELENGTH is set to 128 which may result in buffer overflow since the frame parser allows challenge text of length up to 253 bytes, but the drive...

CVE-2017-11014

CVE-2017-11014 describes a buffer overflow in the Android/CAF/Linux kernel stack when parsing a Measurement Request IE in a Roam Neighbor Action Report. Affected products include Android for MSM, Firefox OS for MSM, and QRD Android with CAF Linux kernel releases. The CVSS data indicates high impa...