CVE-2017-17771

In msmisppreparev4l2buf in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-02-12, an array out of bounds can occur...

CVE-2017-15859

While processing the QCANL80211VENDORSUBCMDSETTXPOWERSCALEDECRDB vendor command, in which attribute QCAWLANVENDORATTRTXPOWERSCALEDECRDB contains fewer than 1 byte, in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-08-11 a buffer overrun occurs...

Integer overflow

In wmapeerinfoeventhandler in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-10-03, the value of numpeers received from firmware is not properly validated so that an integer overflow vulnerability in the size of a buffer allocation may potentially lead to a buffer overflow...

Buffer overflow

While processing the QCANL80211VENDORSUBCMDSETTXPOWERSCALEDECRDB vendor command, in which attribute QCAWLANVENDORATTRTXPOWERSCALEDECRDB contains fewer than 1 byte, in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-08-11 a buffer overrun occurs...

Design/Logic Flaw

In msmisppreparev4l2buf in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-02-12, an array out of bounds can occur...

Buffer overflow

In spectralcreatesampmsg in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-10-11, some values from firmware are not properly validated potentially leading to a buffer overflow...

Buffer overflow

In the function wmaunifiedpowerdebugstatseventhandler in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-10-18, if the value parambuf-numdebugregister received from the FW command buffer is close to max of uint32, then the computation performed using this variable to calculate...

Race condition

There is a race condition in Android for MSM, Firefox OS for MSM, and QRD Android that allows to access to already free'd memory in the debug message output functionality contained within the mobicore driver...

Information disclosure

Information leakage in Android for MSM, Firefox OS for MSM, and QRD Android can occur in the audio driver...

CVE-2017-15826

Due to a race condition in MDSS rotator in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-10-20, a double free vulnerability may potentially exist when two threads free the same perf structures...

CVE-2017-11087

libOmxVenc in Android for MSM, Firefox OS for MSM, and QRD Android copies the output buffer to an application with the "filled length", which is larger than the output buffer's actual size, leading to an information disclosure problem in the context of mediaserver...

CVE-2017-15852

Information leak of the ISPIF base address in Android for MSM, Firefox OS for MSM, and QRD Android can occur in the camera driver...

Stack overflow

The touchscreen driver synapticsdsx in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-06-05, the size of a stack-allocated buffer can be set to a value which exceeds the size of the stack...

Improper access control

In the function msmpcmhwparams in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-09-19, the return value of q6asmopensharedio is not checked properly potentially leading to a possible dangling pointer access...

CVE-2017-17771

In msmisppreparev4l2buf in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-02-12, an array out of bounds can occur...

Null pointer dereference

In the videoioctl2 function in the camera driver in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-09-16, an untrusted pointer dereference may potentially occur...

Design/Logic Flaw

While calling the IPA IOCTL handler for IPAIOCADDHDRPROCCTX in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-10-13, a use-after-free condition may potentially occur...

CVE-2017-17769

Information leakage in Android for MSM, Firefox OS for MSM, and QRD Android can occur in the audio driver...

CVE-2017-14875

In the handler for the ioctl command VIDIOCMSMISPDUALHWLPMMODE in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-05-23, a heap overread vulnerability exists...

CVE-2017-14877

While the IPA driver in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-08-31 is processing IOCTL commands there is no mutex lock of allocated memory. If one thread sends an ioctl cmd IPAIOCQUERYRTTBLINDEX while another sends an ioctl cmd IPAIOCDELRTRULE, a use-after-free conditi...