CVE-2017-11082

CVE-2017-11082 affects Qualcomm WLAN in Android on MSM (and related CAF/Linux kernel builds) where a race condition in the firmware loading routine could lead to a buffer overflow if multiple user-space threads update the WLAN firmware file via sysfs. The root cause is a race in the firmware load...

CVE-2017-18059

CVE-2017-18059 affects Qualcomm WLAN/WMA on Android platforms (Android for MSM, Firefox OS for MSM, QRD Android) with CAF Linux kernel. The root cause is improper input validation of the vdev id in wma_scan_event_callback() (received from firmware), which can lead to an out-of-bounds memory read....

CVE-2017-11082

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, due to a race condition in a firmware loading routine, a buffer overflow could potentially occur if multiple user space threads try to update the WLAN firmware file through sysfs...

CVE-2017-14889

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, due to the lack of a range check on the array index into the WMI descriptor pool, arbitrary address execution may potentially occur in the process mgmt completion handler...

CVE-2017-18055

The CVE-2017-18055 issue is a buffer overflow in Qualcomm WLAN/Wma. Root cause: improper input validation of wmi_event->num_vdev_mac_entries in wma_pdev_set_hw_mode_resp_evt_handler(), as the event is received from firmware. Affected software/hardware: Android on MSM platforms (CAF/Linux kerne...

CVE-2017-18062

CVE-2017-18062 affects Qualcomm Wma in Android devices (Wma driver) with CAF-based Android/Linux stacks. Root cause: potential buffer overflow in wma_process_utf_event() while handling UTF events, leading to local elevation of privilege (EoP). Documented impact: EoP with high confidentiality, int...

CVE-2017-15834

CVE-2017-15834: A race condition in Qualcomm Diagchar's diag_dbgfs_read_dcistats while accessing diag_dbgfs_dci_data_index in Android for MSM platforms (CAF Linux kernel lineage) can lead to a heap overflow. Affected components include Qualcomm diagchar and kernel subsystems across Android builds...

Buffer overflow

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for p2pnoainfo in wmasendbcnbufll which is received from firmware leads to potential buffer overflow...

CVE-2016-10393

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, when processing a clip with large size values, integer arithmetic overflows, and allocated buffer size will be less than intended buffer size. The following buffer operations will...

CVE-2017-18063

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for nloevent in wmanlomatchevthandler, which is received from firmware, leads to potential out of bound memory access...

Buffer overflow

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper buffer length calculation in wmaroamscanfilter leads to buffer overflow...

Buffer overflow

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation while processing an encrypted authentication management frame in limsendauthmgmtframe leads to buffer overflow...

Buffer overflow

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper message length calculation in oemcmdhandler while processing a WLANNLMSGOEM netlink message leads to buffer overread...

Design/Logic Flaw

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, when processing a clip with large size values, integer arithmetic overflows, and allocated buffer size will be less than intended buffer size. The following buffer operations will...

CVE-2017-15821

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the function wmap2pnoaeventhandler, there is no bound check on a value coming from firmware which can potentially lead to a buffer overwrite...

CVE-2017-18056

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for vdevid in wmaunifiedbcntxstatuseventhandler which is received from firmware leads to potential out of bounds memory read...

CVE-2017-14885

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, wmaunifiedlinkpeerstatseventhandler function has a variable numrates which represents the sum of all the peerstats-numrates. The current behavior in this function is to validate only th...

CVE-2017-18068

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper buffer length calculation in wmaroamscanfilter leads to buffer overflow...

CVE-2016-10393

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, when processing a clip with large size values, integer arithmetic overflows, and allocated buffer size will be less than intended buffer size. The following buffer operations will...

CVE-2017-18056

CVE-2017-18056 affects Android for MSM, Firefox OS for MSM, and CAF Linux-kernel builds, where improper input validation for vdev_id in wma_unified_bcntx_status_event_handler() (received from firmware) can cause an out-of-bounds memory read. The issue is tied to the WLAN stack (Qualcomm component...