CVE-2017-14878

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a length variable which is used to copy data has a size of only 8 bits and can be exceeded resulting in a denial of service...

CVE-2017-18063

CVE-2017-18063 affects Android for MSM (CAF Linux kernel) with WLAN firmware; the issue is improper input validation for nlo_event in wma_nlo_match_evt_handler(), which can cause out-of-bounds memory access. Affected products are Android builds for MSM/CAF and related devices using the Linux kern...

CVE-2017-14882

CVE-2017-14882 affects Android for MSM, Firefox OS for MSM, QRD Android, and CAF Linux-kernel builds. The issue stems from processing a VENDOR specific action frame in lim_process_action_vendor_specific(), where the incoming action frame body is length-validated, allowing potential out-of-bounds ...

Integer overflow

In all Qualcomm products with Android releases from CAF using the Linux kernel, multiple values received from firmware are not properly validated in wmagetllstatsextbuf and are used to allocate the sizes of buffers and may be vulnerable to integer overflow leading to buffer overflow...

Stack overflow

In all Qualcomm products with Android releases from CAF using the Linux kernel, while processing an encrypted authentication management frame, a stack buffer overflow may potentially occur...

CVE-2017-17764

In all Qualcomm products with Android releases from CAF using the Linux kernel, the numfailureinfo value from firmware is not properly validated in wmarxaggrfailureeventhandler so that an integer overflow vulnerability in a buffer size calculation may potentially lead to a buffer overflow...

Design/Logic Flaw

In all Qualcomm products with Android releases from CAF using the Linux kernel, in a KGSL IOCTL handler, a Use After Free Condition can potentially occur...

CVE-2017-15817

In all Qualcomm products with Android releases from CAF using the Linux kernel, when an access point sends a challenge text greater than 128 bytes, the host driver is unable to validate this potentially leading to authentication failure...

CVE-2017-15861

In all Qualcomm products with Android releases from CAF using the Linux kernel, in the function wmaroamsyncheventhandler, vdevid is received from firmware and used to access an array without validation...

CVE-2017-14884

In all Qualcomm products with Android releases from CAF using the Linux kernel, due to lack of bounds checking on the variable "datalen" from the function WLANQCMBRMcProcessMsg, a buffer overflow may potentially occur in WLANFTMMcProcessMsg...

CVE-2017-17767

In all Qualcomm products with Android releases from CAF using the Linux kernel, the IL client may free a buffer OMX Video Encoder Component and then subsequently access the already freed buffer...

Race condition

In all Qualcomm products with Android releases from CAF using the Linux kernel, a race condition exists in a GPU Driver which can potentially lead to a Use After Free condition...

CVE-2017-15820

In all Qualcomm products with Android releases from CAF using the Linux kernel, in a KGSL IOCTL handler, a Use After Free Condition can potentially occur...

CVE-2017-15860

In all Qualcomm products with Android releases from CAF using the Linux kernel, while processing an encrypted authentication management frame, a stack buffer overflow may potentially occur...

CVE-2017-17764

CVE-2017-17764 describes an integer overflow in the firmware-driven buffer-size calculation inside Qualcomm WLAN’s wma_rx_aggr_failure_event_handler() for CAF Android/Linux-kernel builds. The flaw can allow a crafted failure-info value to cause a buffer overflow, enabling local elevation of privi...

CVE-2017-15860

CVE-2017-15860 affects Qualcomm WLAN in Android CAF builds using the Linux kernel. In these releases, processing an encrypted authentication management frame can trigger a stack buffer overflow in the Qualcomm component, with the Android bulletin listing this as a Remote Code Execution (RCE) vuln...

CVE-2017-15862

CVE-2017-15862 is a Qualcomm WLAN vulnerability reported across Android CAF/Linux kernel builds. The issue arises in the function wma_unified_link_radio_stats_event_handler(), where the firmware-provided count of radio channels is not properly validated, potentially triggering an integer overflow...

CVE-2017-17765

CVE-2017-17765 concerns Qualcomm WLAN in Android CAF builds using the Linux kernel. The issue arises when values received from firmware are not properly validated in the function wma_get_ll_stats_ext_buf() , causing an integer overflow in buffer size calculations that can lead to a buffer overflo...

CVE-2017-17767

In all Qualcomm products with Android releases from CAF using the Linux kernel, the IL client may free a buffer OMX Video Encoder Component and then subsequently access the already freed buffer...

CVE-2017-15861

CVE-2017-15861 describes an elevation-risk issue in Qualcomm WLAN on Android CAF with Linux kernel where wma_roam_synch_event_handler uses a firmware-provided vdev_id to index an array without validation. This could potentially lead to out-of-bounds access affecting confidentiality, integrity, an...