CVE-2018-11280

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, while processing user-space there is no size validation of the NAT entry input. If the user input size of the NAT entry is greater than the max allowed size, memory exhaustion will occur...

CVE-2018-11286

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, while accessing global variable "debugclient" in multi-thread manner, Use after free issue occurs...

CVE-2018-11270

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, memory allocated with devmkzalloc is automatically released by the kernel if the probe function fails with an error code. This may result in data corruption...

CVE-2018-11274

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, buffer overflow may occur when payload size is extremely large...

CVE-2018-11275

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, when flashing image using FastbootLib if size is not divisible by block size, information leak occurs...

CVE-2018-11265

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, possible buffer overflow while incrementing the logbuf of type uint64t in memcpy function, since the logbuf pointer can access the memory beyond the size to store the data after pointer...

Design/Logic Flaw

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, while processing user-space there is no size validation of the NAT entry input. If the user input size of the NAT entry is greater than the max allowed size, memory exhaustion will occur...

Double free

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, 'voicesvcdev' is allocated as a device-managed resource. If error 'cdevallocerr' occurs, 'devicedestroy' will free all associated resources, including 'voicesvcdev' leading to a double free...

Code injection

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, Venus HW searches for start code when decoding input bit stream buffers. If start code is not found in entire buffer, there is over-fetch beyond allocation length. This leads to page fault...

Input validation

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, improper validation of array index in WMA roam synchronization handler can lead to OOB write...

Design/Logic Flaw

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, lack of check on input received to calculate the buffer length can lead to out of bound write to kernel stack...

Input validation

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, improper check In the WMA API for the inputs received from the firmware and then fills the same to the host structure will lead to OOB write...

Buffer overflow

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, lack of check of input received from firmware to calculate the length of WMA roam synch buffer can lead to buffer overwrite during memcpy...

Code injection

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, in wmandpconfirmeventhandler and wmandpindicationeventhandler, ndpcfg len and numndpappinfo is from fw. If they are not checked, it may cause buffer over-read once the value is too large...

Buffer overflow

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, buffer overflow may occur when payload size is extremely large...

CVE-2017-15828

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, while accessing the keystore in LK, an integer overflow vulnerability exists which may potentially lead to a buffer overflow...

CVE-2017-15844

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, while processing the function for writing device values into flash, uninitialized memory can be written to flash...

Buffer overflow

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, while processing SETPASSPOINTLIST vendor command HDD does not make sure that the realm string that gets passed by upper-layer is NULL terminated. This may lead to buffer overflow as strlen is...

Buffer overflow

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, lack of check of input received from userspace before copying into buffer can lead to potential array overflow in WLAN...

Design/Logic Flaw

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, during wlan association, driver allocates memory. In case the mem allocation fails driver does a mem free though the memory was not allocated...