CVE-2018-3577

While processing fragments, when the fragment count becomes very large, an integer overflow leading to a buffer overflow can occur in Android releases from CAF using the linux kernel Android for MSM, Firefox OS for MSM, QRD Android before security patch level 2018-06-05...

CVE-2018-5836

In wmananrspeventhandler in Android releases from CAF using the linux kernel Android for MSM, Firefox OS for MSM, QRD Android before security patch level 2018-06-05, the datalen value is received from firmware and not properly validated which could potentially lead to an out-of-bounds access...

CVE-2018-5835

If the seqlen is greater then CSRMAXRSCLEN, a buffer overflow in wlanhddcfg80211addkey may occur when copying keyRSC in Android releases from CAF using the linux kernel Android for MSM, Firefox OS for MSM, QRD Android before security patch level 2018-06-05...

CVE-2018-5832

Due to a race condition in a camera driver ioctl handler in Android releases from CAF using the linux kernel Android for MSM, Firefox OS for MSM, QRD Android before security patch level 2018-06-05, a Use After Free condition can occur...

CVE-2018-5830

While processing the HTTT2HMSGTYPEMGMTTXCOMPLIND message, a buffer overflow can potentially occur in Android releases from CAF using the linux kernel Android for MSM, Firefox OS for MSM, QRD Android before security patch level 2018-06-05...

CVE-2018-5829

In wlanhddcfg80211setprivacyibss in Android releases from CAF using the linux kernel Android for MSM, Firefox OS for MSM, QRD Android before security patch level 2018-06-05, a buffer over-read can potentially occur...

CVE-2018-5899

In Android releases from CAF using the linux kernel Android for MSM, Firefox OS for MSM, QRD Android before security patch level 2018-06-05, whenever TDLS connection is setup, we are freeing the netbuf in oltxcompletionhandler and after that, we are accessing it in NBUFUPDATETXPKTCOUNT causing a...

CVE-2018-5889

CVE-2018-5889 affects Qualcomm bootloader components. The connected records classify it as a Local Elevation of Privilege (EoP) vulnerability in the bootloader, with a moderate severity. The issue is described as a buffer overflow occurring in Android releases from CAF when processing a compresse...

CVE-2018-5896

In Android releases from CAF using the linux kernel Android for MSM, Firefox OS for MSM, QRD Android before security patch level 2018-06-05, kernel panic may happen due to out-of-bound read, caused by not checking source buffer length against length of packet stream to be copied...

CVE-2017-15856

CVE-2017-15856 affects Android releases from CAF using the Linux kernel, due to a race condition when processing the power_stats debug file that can cause a double-free. This yields elevation of privilege on local access. The issue involves the Qualcomm power_stats debugfs node; patches tied to t...

CVE-2018-5831

In the KGSL driver in Android releases from CAF using the linux kernel Android for MSM, Firefox OS for MSM, QRD Android before security patch level 2018-06-05, a reference counting error can lead to a Use After Free condition...

CVE-2018-5893

CVE-2018-5893 is a buffer overwrite in the Qualcomm WLAN driver (htt_t2h_msg_handler_fast()) within Android CAF/Linux kernel for MSM devices. Root cause: buffer overwrite during firmware message processing. Affected: Qualcomm WLAN component in Android on CAF Android for MSM, Firefox OS for MSM, Q...

CVE-2018-5887

While processing the USB StrSerialDescriptor array, an array index out of bounds can occur in Android releases from CAF using the linux kernel Android for MSM, Firefox OS for MSM, QRD Android before security patch level 2018-06-05...

CVE-2017-15824

CVE-2017-15824 affects Android CAF-based builds (Android for MSM, Firefox OS for MSM, QRD Android) prior to 2018-06-05. Root cause: UpdateDeviceStatus() writes an uninitialized local stack buffer to flash via WriteToPartition(), enabling a potential memory leak and information disclosure. Impact ...

NULL pointer dereference in ModuleState::setup, in ModuleState.cpp

There exists one NULL pointer dereference bug in ModuleState::se...

CVE-2018-5872

While parsing over-the-air information elements in all Android releases from CAF using the Linux kernel Android for MSM, Firefox OS for MSM, QRD Android before security patch level 2018-07-05, the use of an out-of-range pointer offset can occur...

Design/Logic Flaw

User process can perform the kernel DOS in ashmem when doing cache maintenance operation in all Android releasesAndroid for MSM, Firefox OS for MSM, QRD Android from CAF using the Linux kernel...

Code injection

In the MDSS driver in all Android releasesAndroid for MSM, Firefox OS for MSM, QRD Android from CAF using the Linux kernel, a data structure may be used without being initialized correctly...

Buffer overflow

If userspace provides a too-large WPA RSN IE length in wlanhddcfg80211setie, a buffer overflow occurs in all Android releasesAndroid for MSM, Firefox OS for MSM, QRD Android from CAF using the Linux kernel...

CVE-2017-18169

User process can perform the kernel DOS in ashmem when doing cache maintenance operation in all Android releasesAndroid for MSM, Firefox OS for MSM, QRD Android from CAF using the Linux kernel...