CVE-2017-11007: Improper Restriction of Operations within the Bounds of a Memory Buffer

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, there is a possibility of stack corruption due to buffer overflow of Partition name while converting ascii string to unicode string in function HandleMetaImgFlash...

CVE-2017-11006: Use After Free

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a Use After Free condition can occur during positioning...

PT-2017-13739

Name of the Vulnerable Software and Affected Versions Android for MSM affected versions not specified Firefox OS for MSM affected versions not specified QRD Android affected versions not specified Description The issue affects Android for MSM, Firefox OS for MSM, and QRD Android, with all Android...

CVE-2017-14897: Improper Restriction of Operations within the Bounds of a Memory Buffer

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while handling the QSEOSRPMBCHECKPROVSTATUSCOMMAND, a userspace buffer is directly accessed in kernel space...

CVE-2017-14900: Improper Restriction of Operations within the Bounds of a Memory Buffer

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing the QCANL80211VENDORSUBCMDGETCHAINRSSI vendor command, in which attribute QCAWLANVENDORATTRMACADDR contains fewer than 6 bytes, a buffer overrun occurs...

CVE-2017-11049: Improper Restriction of Operations within the Bounds of a Memory Buffer

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in a video driver, a race condition exists which can potentially lead to a buffer overflow...

CVE-2017-14895: Operation on a Resource after Expiration or Release

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, after a subsystem reset, iwpriv is not giving correct information...

PT-2017-19120

Name of the Vulnerable Software and Affected Versions Android for MSM affected versions not specified Firefox OS for MSM affected versions not specified QRD Android affected versions not specified Description A buffer overwrite issue is present in the fw name store function when an image name of ...

PT-2017-13749

Name of the Vulnerable Software and Affected Versions Android for MSM affected versions not specified Firefox OS for MSM affected versions not specified QRD Android affected versions not specified Description A crafted binder request can cause an arbitrary unmap in MediaServer, potentially leadin...

CVE-2017-11016: Improper Resource Shutdown or Release

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, when memory allocation fails while creating a calibration block in createcalblock stale pointers are left uncleared...

CVE-2017-14905: Out-of-bounds Read

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing a specially crafted cfg80211 vendor command, a buffer over-read can occur...

CVE-2017-14899: Improper Restriction of Operations within the Bounds of a Memory Buffer

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing the QCANL80211VENDORSUBCMDSETTXPOWERSCALEDECRDB vendor command, in which attribute QCAWLANVENDORATTRTXPOWERSCALEDECRDB contains fewer than 1 byte, a buffer overrun occu...

CVE-2017-14896: Improper Restriction of Operations within the Bounds of a Memory Buffer

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, there is a memory allocation without a length field validation in the mobicore driver which can result in an undersize buffer allocation. Ultimately this can result in a kernel memory...

CVE-2017-14917: Improper Restriction of Operations within the Bounds of a Memory Buffer

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, buffer sizes in the message passing interface are not properly validated...

CVE-2017-11044: Concurrent Execution using Shared Resource with Improper Synchronization

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in a KGSL driver function, a race condition exists which can lead to a Use After Free condition...

CVE-2017-14898: Improper Restriction of Operations within the Bounds of a Memory Buffer

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing the QCANL80211VENDORSUBCMDSETTXPOWERSCALE vendor command, in which attribute QCAWLANVENDORATTRTXPOWERSCALE contains fewer than 1 byte, a buffer overrun occurs...

PT-2017-11711

Name of the Vulnerable Software and Affected Versions Android for MSM affected versions not specified Firefox OS for MSM affected versions not specified QRD Android affected versions not specified Description A race condition exists in the video driver of the affected systems, potentially leading...

CVE-2017-9722: Improper Restriction of Operations within the Bounds of a Memory Buffer

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, when updating custom EDID hdmitxsysfswtaedid, if edidsize, which is controlled by userspace, is too large, a buffer overflow occurs...

CVE-2017-9709: Undefined Security Weakness

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a privilege escalation vulnerability exists in telephony...

CVE-2017-9698: Improper Restriction of Operations within the Bounds of a Memory Buffer

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improperly specified offset/size values for a submission command could cause a math operation to overflow and could result in an access to arbitrary memory. The combined pointer will...