Buffer overflow

In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05, a buffer overwrite may occur in ProcSetReqInternal due to missing length check...

Integer overflow

In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05, if the firmware sends a service ready event to the host with a large number in the numhwmodes or numphy, then it could result in an...

Integer overflow

In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05, in the function wmatbttoffsetupdateeventhandler, a parameter received from firmware is used to allocate memory for a local buffer and ...

Code injection

In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05, a policy for the packet pattern attribute NL80211PKTPATOFFSET is not defined which can lead to a buffer over-read in nlagetu32...

CVE-2017-15853

In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05, while processing PTT commands, pttsocksendmsgtoapp is invoked without validating the packet length. If the packet length is invalid,...

CVE-2017-14894

In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05, in wmavdevstartresphandler, vdev id is received from firmware as part of WMIVDEVSTARTRESPEVENTID. This vdev id can be greater than max...

CVE-2018-5821

In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with CAF builds prior to the 2018-04-05 kernel patch level, CVE-2018-5821 is a memory error in wma_wow_wakeup_host_event() where wake_info->vdev_id from FW is used as an index into wma->interfaces, potentially reading beyond t...

CVE-2017-18147

CVE-2017-18147 affects Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android builds from CAF using the Linux kernel prior to the 2018-04-05 patch level. In MMCP, a downlink message is not properly validated, enabling potential network-based impact without authentication. CVSS metrics indi...

CVE-2018-5823

CVE-2018-5823 affects Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android on CAF Android kernels prior to the 2018-04-05 patch level. The vulnerability is due to improper buffer length validation in the extscan hotlist event, leading to a potential buffer overflow. The NVD/NVD-affiliate...

CVE-2017-14894

CVE-2017-14894 affects Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android builds using CAF with the Linux kernel prior to the 2018-04-05 patch level. In wma_vdev_start_resp_handler(), the vdev_id received from firmware can exceed the maximum BSSID stored in wma_handle->interfaces, l...

CVE-2017-14890

The CVE-2017-14890 entry covers a buffer overwrite in Qualcomm WLAN via wma_send_bcn_buf_ll() during SWBA event handling, caused by improper validation of vdev_map in Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android builds using CAF Linux kernels prior to the 2018-04-05 patch level. ...

CVE-2018-5826

CVE-2018-5826 describes a race condition leading to a Use-After-Free in the Qualcomm WLAN driver (qcacld-3.0 HDD driver) affecting Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android on CAF builds with Linux kernels before the 2018-04-05 patch level. The root cause is a race in the WLAN...

CVE-2018-5828

Vulnerability CVE-2018-5828 affects Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android builds with CAF Linux kernels prior to 2018-04-05. The issue is in function wma_extscan_start_stop_event_handler() where vdev_id is taken from firmware and not properly validated, potentially leading...

CVE-2018-3599

In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05, while notifying a DCI client, a Use After Free condition can occur...

CVE-2017-15822

CVE-2017-15822 affects Qualcomm-based Android devices (MSM) including Firefox OS for MSM and QRD Android builds within CAF releases prior to the 2018-04-05 security patch level. Description: a buffer overflow may occur while processing an 802.11 management frame in the Linux kernel components use...

CVE-2018-3598

In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05, insufficient validation of parameters from userspace in the camera driver can lead to information leak and out-of-bounds access...

CVE-2018-3596

In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05, legacy code vulnerable after migration has been removed...

CVE-2017-17770

CVE-2017-17770 is an Elevation of Privilege in Qualcomm components (Binder) related to a power-driver ioctl Untrusted Pointer Dereference in Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android prior to patch level 2018-04-05. The root cause is an untrusted pointer dereference in a kerne...

CVE-2018-3598

In CVE-2018-3598, the affected components are Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android builds using CAF Linux kernels prior to the 2018-04-05 patch level. The root cause is insufficient validation of parameters from userspace in the camera_v2 driver, leading to an information...

CVE-2017-11075

CVE-2017-11075 concerns a use-after-free in wdsp_glink_write() when cmd_pkt and reg_pkt are invoked from different userspace threads on Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android builds prior to the CAF kernel patch level 2018-04-05. Affected components include the Audio DSP dr...