CVE-2018-5857: Use After Free

In the WCD CPE codec, a Use After Free condition can occur in all Android releasesAndroid for MSM, Firefox OS for MSM, QRD Android from CAF using the Linux kernel...

CVE-2018-5860: Access of Uninitialized Pointer

In the MDSS driver in all Android releasesAndroid for MSM, Firefox OS for MSM, QRD Android from CAF using the Linux kernel, a data structure may be used without being initialized correctly...

CVE-2018-5848

In the function wmisetie, the length validation code does not handle unsigned integer overflow properly. As a result, a large value of the 'ielen' argument can cause a buffer overflow in all Android releases from CAF Android for MSM, Firefox OS for MSM, QRD Android using the Linux Kernel...

CVE-2017-15854: Improper Restriction of Operations within the Bounds of a Memory Buffer

The value of fixparam-numchans is received from firmware and if it is too large, an integer overflow can occur in wmaradiochanstatseventhandler for the derived length len leading to a subsequent buffer overflow in all Android releases from CAF Android for MSM, Firefox OS for MSM, QRD Android usin...

CVE-2018-5821: Out-of-bounds Read

In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05, in function wmawowwakeuphostevent, wakeinfo-vdevid is received from FW and is used directly as array index to access wma-interfaces...

CVE-2018-3598: Exposure of Sensitive Information to an Unauthorized Actor

In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05, insufficient validation of parameters from userspace in the camera driver can lead to information leak and out-of-bounds access...

CVE-2017-18147: Improper Input Validation

In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05, in MMCP, a downlink message is not being properly validated...

CVE-2017-17769

Information leakage in Android for MSM, Firefox OS for MSM, and QRD Android can occur in the audio driver...

CVE-2017-15859

While processing the QCANL80211VENDORSUBCMDSETTXPOWERSCALEDECRDB vendor command, in which attribute QCAWLANVENDORATTRTXPOWERSCALEDECRDB contains fewer than 1 byte, in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-08-11 a buffer overrun occurs...

CVE-2017-17766

In wmapeerinfoeventhandler in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-10-03, the value of numpeers received from firmware is not properly validated so that an integer overflow vulnerability in the size of a buffer allocation may potentially lead to a buffer overflow...

CVE-2018-3561

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a race condition in diagioctllsmdeinit leads to a Use After Free condition...

Out-of-bounds

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in msmflashsubdevdoioctl of drivers/media/platform/msm/camerav2/sensor/flash/msmflash.c, there is a possible out of bounds read if flashdata.cfgtype is CFGFLASHINIT due to improper inpu...

CVE-2018-3561

CVE-2018-3561 is a Qualcomm Diagchar-related issue affecting Android on MSM devices. The root cause is a race condition in diag_ioctl_lsm_deinit() that leads to a Use-After-Free condition. The vulnerability is characterized as Elevation of Privilege (EoP) with local access requirements and high i...

CVE-2017-11082: Improper Restriction of Operations within the Bounds of a Memory Buffer

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, due to a race condition in a firmware loading routine, a buffer overflow could potentially occur if multiple user space threads try to update the WLAN firmware file through sysfs...

CVE-2017-18068

CVE-2017-18068 involves an improper buffer length calculation in wma_roam_scan_filter() that can cause a buffer overflow. Affected are Android for MSM, Firefox OS for MSM, and QRD Android builds using CAF with the Linux kernel. The issue is classified as EoP/High-impact (CVSS v3.0: 7.8) with loca...

Buffer overflow

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while calculating CRC for GPT header fields with partition entries greater than 16384 buffer overflow occurs...

CVE-2017-9689

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a specially-crafted HDMI CEC message can be used to cause stack memory corruption...

UBUNTU-CVE-2017-15847

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the SPCom kernel driver, a race condition exists when creating a channel...

CVE-2017-11069

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, manipulation of SafeSwitch Image data can result in Heap overflow...

CVE-2017-15845: Improper Input Validation

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, an invalid input of firmware size negative value from user space can potentially lead to the memory leak or buffer overflow during the WLAN cal data store operation...