1529 matches found
Command injection
In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, while processing the WLAN driver command ioctl a temporary buffer used to construct the reply message may be freed twice...
Design/Logic Flaw
In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, when flashing image using FastbootLib if size is not divisible by block size, information leak occurs...
Design/Logic Flaw
In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, lack fo check on return value in WMA response handler can lead to potential use after free...
Design/Logic Flaw
In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, callback executed from the other thread has freed memory which is also used in wlan function and may result in to a "Use after free" scenario...
Input validation
In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, WLAN handler indication from the firmware gets the information for 4 access categories. While processing this information only the first 3 AC information is copied due to the improper...
Buffer overflow
In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, while processing a message from firmware in WLAN handler, a buffer overwrite can occur...
Buffer overflow
In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, a potential buffer over flow could occur while processing the ndp event due to lack of check on the message length...
Integer overflow
In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, while loading a user application in qseecom, an integer overflow could potentially occur if the application partition size is rounded up to pagesize...
Design/Logic Flaw
In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, while processing the function for writing device values into flash, uninitialized memory can be written to flash...
Integer overflow
In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, lack of check on integer overflow while calculating memory can lead to Buffer overflow in WLAN ext scan handler...
Design/Logic Flaw
In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, when WLAN FW has not filled the vdev id correctly in stats events then WLAN host driver tries to access interface array without proper bound check which can lead to invalid memory access and ...
CVE-2018-11818
In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, LUT configuration is passed down to driver from userspace via ioctl. Simultaneous update from userspace while kernel drivers are updating LUT registers can lead to race condition...
CVE-2018-11278
CVE-2018-11278 affects CAF Venus HW in Android for MSM, Firefox OS for MSM, and QRD Android builds. The vulnerability occurs when Venus HW decodes input bit stream buffers: it searches for a start code, and if the start code is not found in the entire buffer, the implementation may over-fetch bey...
CVE-2018-11280
In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, while processing user-space there is no size validation of the NAT entry input. If the user input size of the NAT entry is greater than the max allowed size, memory exhaustion will occur...
CVE-2018-11276
In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, double free of memory allocation is possible in Kernel when it explicitly tries to free that memory on driver probe failure, since memory allocated is automatically freed on probe...
CVE-2018-11273
In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, 'voicesvcdev' is allocated as a device-managed resource. If error 'cdevallocerr' occurs, 'devicedestroy' will free all associated resources, including 'voicesvcdev' leading to a double free...
CVE-2018-11301
In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, lack of check on buffer length while processing debug log event from firmware can lead to an integer overflow...
CVE-2018-11274
In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, buffer overflow may occur when payload size is extremely large...
CVE-2018-11278
In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, Venus HW searches for start code when decoding input bit stream buffers. If start code is not found in entire buffer, there is over-fetch beyond allocation length. This leads to page fault...