CVE-2018-5835

CVE-2018-5835 describes a potential buffer overflow in the Android WLAN stack: when seq_len exceeds CSR_MAX_RSC_LEN, copying keyRSC in __wlan_hdd_cfg80211_add_key() may overflow. This affects Android releases from CAF using the Linux kernel (Android for MSM, Firefox OS for MSM, QRD Android). The ...

CVE-2018-3577

While processing fragments, when the fragment count becomes very large, an integer overflow leading to a buffer overflow can occur in Android releases from CAF using the linux kernel Android for MSM, Firefox OS for MSM, QRD Android before security patch level 2018-06-05...

CVE-2018-5836

In wmananrspeventhandler in Android releases from CAF using the linux kernel Android for MSM, Firefox OS for MSM, QRD Android before security patch level 2018-06-05, the datalen value is received from firmware and not properly validated which could potentially lead to an out-of-bounds access...

CVE-2018-5830

While processing the HTTT2HMSGTYPEMGMTTXCOMPLIND message, a buffer overflow can potentially occur in Android releases from CAF using the linux kernel Android for MSM, Firefox OS for MSM, QRD Android before security patch level 2018-06-05...

CVE-2018-5829

In wlanhddcfg80211setprivacyibss in Android releases from CAF using the linux kernel Android for MSM, Firefox OS for MSM, QRD Android before security patch level 2018-06-05, a buffer over-read can potentially occur...

CVE-2018-5899

In Android releases from CAF using the linux kernel Android for MSM, Firefox OS for MSM, QRD Android before security patch level 2018-06-05, whenever TDLS connection is setup, we are freeing the netbuf in oltxcompletionhandler and after that, we are accessing it in NBUFUPDATETXPKTCOUNT causing a...

CVE-2018-5889

CVE-2018-5889 affects Qualcomm bootloader components. The connected records classify it as a Local Elevation of Privilege (EoP) vulnerability in the bootloader, with a moderate severity. The issue is described as a buffer overflow occurring in Android releases from CAF when processing a compresse...

CVE-2018-5896

In Android releases from CAF using the linux kernel Android for MSM, Firefox OS for MSM, QRD Android before security patch level 2018-06-05, kernel panic may happen due to out-of-bound read, caused by not checking source buffer length against length of packet stream to be copied...

CVE-2018-5832

Due to a race condition in a camera driver ioctl handler in Android releases from CAF using the linux kernel Android for MSM, Firefox OS for MSM, QRD Android before security patch level 2018-06-05, a Use After Free condition can occur...

CVE-2018-5831

In the KGSL driver in Android releases from CAF using the linux kernel Android for MSM, Firefox OS for MSM, QRD Android before security patch level 2018-06-05, a reference counting error can lead to a Use After Free condition...

CVE-2018-5893

CVE-2018-5893 is a buffer overwrite in the Qualcomm WLAN driver (htt_t2h_msg_handler_fast()) within Android CAF/Linux kernel for MSM devices. Root cause: buffer overwrite during firmware message processing. Affected: Qualcomm WLAN component in Android on CAF Android for MSM, Firefox OS for MSM, Q...

CVE-2018-5887

While processing the USB StrSerialDescriptor array, an array index out of bounds can occur in Android releases from CAF using the linux kernel Android for MSM, Firefox OS for MSM, QRD Android before security patch level 2018-06-05...

CVE-2017-15824

CVE-2017-15824 affects Android CAF-based builds (Android for MSM, Firefox OS for MSM, QRD Android) prior to 2018-06-05. Root cause: UpdateDeviceStatus() writes an uninitialized local stack buffer to flash via WriteToPartition(), enabling a potential memory leak and information disclosure. Impact ...

CVE-2017-15856

CVE-2017-15856 affects Android releases from CAF using the Linux kernel, due to a race condition when processing the power_stats debug file that can cause a double-free. This yields elevation of privilege on local access. The issue involves the Qualcomm power_stats debugfs node; patches tied to t...

CVE-2018-5835

If the seqlen is greater then CSRMAXRSCLEN, a buffer overflow in wlanhddcfg80211addkey may occur when copying keyRSC in Android releases from CAF using the linux kernel Android for MSM, Firefox OS for MSM, QRD Android before security patch level 2018-06-05...

NULL pointer dereference in ModuleState::setup, in ModuleState.cpp

There exists one NULL pointer dereference bug in ModuleState::se...

CVE-2018-5830: Improper Restriction of Operations within the Bounds of a Memory Buffer

While processing the HTTT2HMSGTYPEMGMTTXCOMPLIND message, a buffer overflow can potentially occur in Android releases from CAF using the linux kernel Android for MSM, Firefox OS for MSM, QRD Android before security patch level 2018-06-05...

CVE-2018-3577: Integer Overflow or Wraparound

While processing fragments, when the fragment count becomes very large, an integer overflow leading to a buffer overflow can occur in Android releases from CAF using the linux kernel Android for MSM, Firefox OS for MSM, QRD Android before security patch level 2018-06-05...

CVE-2018-3597: Improper Input Validation

In the ADSP RPC driver in Android releases from CAF using the linux kernel Android for MSM, Firefox OS for MSM, QRD Android before security patch level 2018-06-05, an arbitrary kernel write can occur...

CVE-2018-5889: Improper Restriction of Operations within the Bounds of a Memory Buffer

While processing a compressed kernel image, a buffer overflow can occur in Android releases from CAF using the linux kernel Android for MSM, Firefox OS for MSM, QRD Android before security patch level 2018-06-05...