CVE-2017-9693

The length of attribute value for STAEXTCAPABILITY in wlanhddchangestation in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-06-06 being less than the actual lenth of StaParams.extncapability results in a read for extra bytes when a memcpy is done from params-extcapab to...

CVE-2017-15826

The CVE-2017-15826 entry describes a race condition in the MDSS rotator used in Android for MSM, Firefox OS for MSM, and QRD Android prior to 2017-10-20, potentially enabling a double-free when two threads free the same perf structures. The NVD entry confirms a LOCAL attack with medium complexity...

CVE-2017-9681

In CVE-2017-9681, the issue affects Android devices using the Linux kernel in Qualcomm MSM/CAF builds (including Firefox OS for MSM and QRD Android). The vulnerability arises when a user-supplied kernel memory address is passed from userspace through the iris_vidioc_s_ext_ctrls ioctl, causing the...

CVE-2017-18065

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for vent-vdevid in wmaactionframefiltermaceventhandler, which is received from firmware, leads to arbitrary code execution...

CVE-2017-18061

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, potential buffer overflow can happen when processing AOA measurement event from WIGIG firmware in wilaoaevtmeas...

CVE-2017-18066

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper controls in MSM CORE leads to use memory after it is freed in msmcoreioctl...

Out-of-bounds

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in msmflashsubdevdoioctl of drivers/media/platform/msm/camerav2/sensor/flash/msmflash.c, there is a possible out of bounds read if flashdata.cfgtype is CFGFLASHINIT due to improper inpu...

CVE-2017-14887

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the processing of messages of type eWNISMEMODIFYADDITIONALIES, an integer overflow leading to heap buffer overflow may potentially occur...

Race condition

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a race condition in diagioctllsmdeinit leads to a Use After Free condition...

Buffer overflow

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for wmievent-numvdevmacentries in wmapdevsethwmoderespevthandler, which is received from firmware, leads to potential buffer overflow...

Buffer overflow

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, potential buffer overflow can happen when processing UTF event in wmaprocessutfevent...

Input validation

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for vent-vdevid in wmaactionframefiltermaceventhandler, which is received from firmware, leads to arbitrary code execution...

Input validation

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for wowbufpktlen in wmawowwakeuphostevent which is received from firmware leads to potential out of bounds memory read...

Input validation

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for respevent-vdevid in wmaunifiedbcntxstatuseventhandler, which is received from firmware, leads to potential out of bounds memory read...

CVE-2017-11074

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, there is an obsolete set/reset ssid hotlist API...

CVE-2017-18051

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for event-vdevid in wmarcpieventhandler, which is received from firmware, leads to potential out of bounds memory read...

Input validation

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for event-vdevid in wmarcpieventhandler, which is received from firmware, leads to potential out of bounds memory read...

Design/Logic Flaw

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, there is an obsolete set/reset ssid hotlist API...

CVE-2017-11082

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, due to a race condition in a firmware loading routine, a buffer overflow could potentially occur if multiple user space threads try to update the WLAN firmware file through sysfs...

Buffer overflow

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, potential buffer overflow can happen when processing AOA measurement event from WIGIG firmware in wilaoaevtmeas...