CVE-2017-14876: Out-of-bounds Write

In msmispifconfigstereo in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-06-21, the parameter params-entriesi.vfeintf comes from userspace without any bounds check which could potentially result in a kernel out-of-bounds write...

CVE-2017-15826: Concurrent Execution using Shared Resource with Improper Synchronization

Due to a race condition in MDSS rotator in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-10-20, a double free vulnerability may potentially exist when two threads free the same perf structures...

PT-2018-6016

Name of the Vulnerable Software and Affected Versions: Android for MSM affected versions not specified Firefox OS for MSM affected versions not specified QRD Android affected versions not specified Description: The issue is related to an information leak of the ISPIF base address in the camera...

PT-2018-5731

Name of the Vulnerable Software and Affected Versions: Android for MSM versions prior to 2017-06-21 Firefox OS for MSM versions prior to 2017-06-21 QRD Android versions prior to 2017-06-21 Description: The issue arises from the lack of bounds checking on the params-entriesi.vfe intf parameter in...

PT-2018-6570

Name of the Vulnerable Software and Affected Versions: Android for MSM affected versions not specified Firefox OS for MSM affected versions not specified QRD Android affected versions not specified Description: The issue is related to information leakage in the audio driver of the affected system...

CVE-2017-14881: Use After Free

While calling the IPA IOCTL handler for IPAIOCADDHDRPROCCTX in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-10-13, a use-after-free condition may potentially occur...

CVE-2017-15823: Improper Restriction of Operations within the Bounds of a Memory Buffer

In spectralcreatesampmsg in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-10-11, some values from firmware are not properly validated potentially leading to a buffer overflow...

CVE-2017-17771: Buffer Copy without Checking Size of Input

In msmisppreparev4l2buf in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-02-12, an array out of bounds can occur...

CVE-2017-14883: Improper Restriction of Operations within the Bounds of a Memory Buffer

In the function wmaunifiedpowerdebugstatseventhandler in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-10-18, if the value parambuf-numdebugregister received from the FW command buffer is close to max of uint32, then the computation performed using this variable to calculate...

CVE-2017-9692: NULL Pointer Dereference

When an atomic commit is issued on a writeback panel with a NULL outputlayer parameter in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-06-03, a NULL pointer dereference may potentially occur...

PT-2018-5318

Name of the Vulnerable Software and Affected Versions Android for MSM affected versions not specified Firefox OS for MSM affected versions not specified QRD Android affected versions not specified Description The issue is related to the libOmxVenc component, which copies the output buffer to an...

CVE-2017-18061

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, potential buffer overflow can happen when processing AOA measurement event from WIGIG firmware in wilaoaevtmeas...

CVE-2017-18065

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for vent-vdevid in wmaactionframefiltermaceventhandler, which is received from firmware, leads to arbitrary code execution...

Out-of-bounds

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in msmflashsubdevdoioctl of drivers/media/platform/msm/camerav2/sensor/flash/msmflash.c, there is a possible out of bounds read if flashdata.cfgtype is CFGFLASHINIT due to improper inpu...

Input validation

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for fixparam-vdevid in wmap2ploeventhandler, which is received from firmware, leads to potential out of bounds memory read...

Input validation

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for wowbufpktlen in wmawowwakeuphostevent which is received from firmware leads to potential out of bounds memory read...

CVE-2017-18061

CVE-2017-18061 affects Android for MSM, Firefox OS for MSM, and QRD Android builds using CAF Linux kernel. The vulnerability stems from a potential buffer overflow when processing an AOA (Android Open Accessory) measurement event from WIGIG firmware in wil_aoa_evt_meas(), with Wil6210 as the rela...

CVE-2017-15833

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, untrusted pointer dereference in updateuserspacepower function in power leads to information exposure...

CVE-2017-18058

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for wowbufpktlen in wmawowwakeuphostevent which is received from firmware leads to potential out of bounds memory read...

CVE-2017-18052

CVE-2017-18052 affects Qualcomm WLAN in Android devices (CAF Linux kernel line) via the wma_mgmt_tx_bundle_completion_handler() function. The root cause is improper input validation for cmpl_params->num_reports, param_buf->desc_ids, and param_buf->status received from firmware, leading t...