Buffer overflow

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a buffer overflow can occur while reading firmware logs...

CVE-2017-11044

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in a KGSL driver function, a race condition exists which can lead to a Use After Free condition...

CVE-2017-11042

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, ImsService and the IQtiImsExt AIDL APIs are not subject to access control...

CVE-2017-14898

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing the QCANL80211VENDORSUBCMDSETTXPOWERSCALE vendor command, in which attribute QCAWLANVENDORATTRTXPOWERSCALE contains fewer than 1 byte, a buffer overrun occurs...

CVE-2017-14899

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing the QCANL80211VENDORSUBCMDSETTXPOWERSCALEDECRDB vendor command, in which attribute QCAWLANVENDORATTRTXPOWERSCALEDECRDB contains fewer than 1 byte, a buffer overrun occu...

CVE-2017-14905

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing a specially crafted cfg80211 vendor command, a buffer over-read can occur...

CVE-2017-15813

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a buffer overflow can occur while reading firmware logs...

CVE-2017-14900

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing the QCANL80211VENDORSUBCMDGETCHAINRSSI vendor command, in which attribute QCAWLANVENDORATTRMACADDR contains fewer than 6 bytes, a buffer overrun occurs...

CVE-2017-14901

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing the QCANL80211VENDORSUBCMDSETTXPOWERSCALE vendor command, in which attribute QCAWLANVENDORATTRTXPOWERSCALE contains fewer than 1 byte, a buffer overrun occurs...

CVE-2017-9698

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improperly specified offset/size values for a submission command could cause a math operation to overflow and could result in an access to arbitrary memory. The combined pointer will...

Buffer overflow

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, when updating custom EDID hdmitxsysfswtaedid, if edidsize, which is controlled by userspace, is too large, a buffer overflow occurs...

Design/Logic Flaw

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, when memory allocation fails while creating a calibration block in createcalblock stale pointers are left uncleared...

Buffer overflow

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing the QCANL80211VENDORSUBCMDSETTXPOWERSCALEDECRDB vendor command, in which attribute QCAWLANVENDORATTRTXPOWERSCALEDECRDB contains fewer than 1 byte, a buffer overrun occu...

CVE-2017-9703

CVE-2017-9703 is a race condition in a Camera driver on Android for MSM, Firefox OS for MSM, and QRD Android (CAF Linux kernel). This Use-After-Free vulnerability is rated CVSS v3.0 base score 7.0 (HIGH) with LOCAL attack vector, high impact on confidentiality, integrity, and availability; CVSS v...

CVE-2017-11042

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, ImsService and the IQtiImsExt AIDL APIs are not subject to access control...

CVE-2017-11033

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the coresight-tmc driver, a simultaneous read and enable of the ETR device after changing the buffer size may result in a Use After Free condition of the previous buffer...

CVE-2017-14900

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing the QCANL80211VENDORSUBCMDGETCHAINRSSI vendor command, in which attribute QCAWLANVENDORATTRMACADDR contains fewer than 6 bytes, a buffer overrun occurs...

CVE-2017-14903

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing the SENDACTIONFRAME IOCTL, a buffer over-read can occur if the payload length is less than 7...

CVE-2017-9708

The CVE-2017-9708 issue affects Android for MSM (and related CAF builds) in the camera driver. The race condition stems from msm_ois_power_down being invoked without a mutex, causing a race in the *reg_ptr variable within msm_camera_config_single_vreg. Impact is described as a race condition with...

CVE-2017-14899

CVE-2017-14899 affects Android for MSM (CAF Linux kernel-based builds) and Qualcomm WLAN components; a buffer overrun occurs when the QCA_NL80211_VENDOR_SUBCMD_SET_TXPOWER_SCALE_DECR_DB attribute contains fewer than 1 byte during processing of the vendor command, potentially enabling local impact...