CVE-2018-11274

CVE-2018-11274 is documented in the Pixel Security Bulletin under Qualcomm components (Audio). The entry classifies it as a moderate-impact audio buffer overflow affecting Qualcomm Audio; no exploitation details are provided in the supplied documents. The bulletin notes security patch levels of 2...

CVE-2018-11286

CVE-2018-11286 pertains to CAF-based Android releases (Android for MSM, Firefox OS for MSM, QRD Android) running the Linux kernel, where a use-after-free occurs when accessing the global variable debug_client in a multi-threaded context. The issue is a memory-management bug in the kernel-componen...

CVE-2018-11295

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, WMA handler carries a fixed event data from the firmware to the host . If the length and anqp length from this event data exceeds the max length, an OOB write would happen...

CVE-2018-11299

CVE-2018-11299 affects CAF WLAN host driver in Android/Linux kernel: when WLAN firmware does not fill the vdev id correctly in stats events, the driver may access an interface array without proper bounds checking, causing invalid memory access and potentially kernel panic or page fault. Connected...

CVE-2018-11302

CVE-2018-11302 corresponds to a WLAN buffer overflow issue described in Qualcomm CAF Android variants (Android for MSM, Firefox OS for MSM, QRD Android) where input from userspace could be copied into a kernel buffer without proper validation. The CVE is listed under the Qualcomm component mappin...

CVE-2018-11293

CVE-2018-11293 affects Qualcomm WLAN Host in Android variants built on CAF Linux kernel (Android for MSM, Firefox OS for MSM, QRD Android). The issue arises in wma_ndp_confirm_event_handler and wma_ndp_indication_event_handler where ndp_cfg_len and num_ndp_app_info are taken from firmware without...

CVE-2018-11843

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, lack fo check on return value in WMA response handler can lead to potential use after free...

CVE-2018-11265

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, possible buffer overflow while incrementing the logbuf of type uint64t in memcpy function, since the logbuf pointer can access the memory beyond the size to store the data after pointer...

CVE-2017-15828

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, while accessing the keystore in LK, an integer overflow vulnerability exists which may potentially lead to a buffer overflow...

CVE-2018-11827

CVE-2018-11827 affects CAF/Android builds (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux kernel. The issue: improper validation of an array index in the WMA roam synchronization handler can cause an out-of-bounds write. This is tied to Qualcomm WLAN/driver components in the af...

CVE-2018-11869

CVE-2018-11869 affects Android-family releases used on CAF/Linux kernels. The issue is a lack of length validation for a value received from firmware, which can cause a buffer overflow in the WMA handler . The vulnerability is described as local with potential complete impact on confidentiality, ...

CVE-2018-11265

CVE-2018-11265 concerns a buffer overflow in Qualcomm MProc when Android CAF/Linux kernel handles log_buf with a uint64_t; the log_buf pointer may access memory beyond bounds when incremented in memcpy. Multiple sources (NVD entry and CNVD/PRION-style mappings) associate this with Android on Pixe...

CVE-2018-11826

CVE-2018-11826 causes a buffer overflow in the WLAN ext scan handler due to a missing check for integer overflow during memory size calculations in CAF Android/Linux kernel components. Affected: Qualcomm WLAN HOST (Android CAF stack). The issue is documented across multiple sources (NVD entry and...

CVE-2018-11273

The CVE-2018-11273 entry describes a double-free in voice_svc_dev when CAF’s Linux kernel device allocation hits cdev_alloc_err and device_destroy frees all resources. Affected are Android for MSM, Firefox OS for MSM, and QRD Android builds using CAF’s kernel. The root cause is that voice_svc_dev...

CVE-2018-11298

CVE-2018-11298 concerns a buffer overflow in Qualcomm WLAN Host within Android CAF builds using the Linux kernel. During processing of the SET_PASSPOINT_LIST command, the realm string passed from upper layers is not guaranteed to be NULL terminated, allowing strlen to determine its length and con...

CVE-2018-11860

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, a potential buffer over flow could occur while processing the ndp event due to lack of check on the message length...

CVE-2018-11300

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, callback executed from the other thread has freed memory which is also used in wlan function and may result in to a "Use after free" scenario...

CVE-2018-11868

CVE-2018-11868 describes a buffer overflow in the nan response event handler due to lack of length validation for values received from firmware. The issue affects Android releases (Android for MSM, Firefox OS for MSM, QRD Android) derived from CAF using the Linux kernel, with the root cause being...

CVE-2018-11863

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, lack of check of input received from firmware to calculate the length of WMA roam synch buffer can lead to buffer overwrite during memcpy...

CVE-2018-11851

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, lack of check on input received to calculate the buffer length can lead to out of bound write to kernel stack...