Heap overflow

In the handler for the ioctl command VIDIOCMSMISPDUALHWLPMMODE in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-05-23, a heap overread vulnerability exists...

Buffer overflow

In spectralcreatesampmsg in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-10-11, some values from firmware are not properly validated potentially leading to a buffer overflow...

CVE-2017-17769

Information leakage in Android for MSM, Firefox OS for MSM, and QRD Android can occur in the audio driver...

CVE-2017-15852

Information leak of the ISPIF base address in Android for MSM, Firefox OS for MSM, and QRD Android can occur in the camera driver...

CVE-2017-9691

There is a race condition in Android for MSM, Firefox OS for MSM, and QRD Android that allows to access to already free'd memory in the debug message output functionality contained within the mobicore driver...

Improper access control

In the function msmpcmhwparams in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-09-19, the return value of q6asmopensharedio is not checked properly potentially leading to a possible dangling pointer access...

Race condition

There is a race condition in Android for MSM, Firefox OS for MSM, and QRD Android that allows to access to already free'd memory in the debug message output functionality contained within the mobicore driver...

Out-of-bounds

In msmispifconfigstereo in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-06-21, the parameter params-entriesi.vfeintf comes from userspace without any bounds check which could potentially result in a kernel out-of-bounds write...

CVE-2017-17771

In msmisppreparev4l2buf in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-02-12, an array out of bounds can occur...

Design/Logic Flaw

In msmisppreparev4l2buf in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-02-12, an array out of bounds can occur...

CVE-2017-14881

While calling the IPA IOCTL handler for IPAIOCADDHDRPROCCTX in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-10-13, a use-after-free condition may potentially occur...

CVE-2017-15859

CVE-2017-15859 is a buffer overrun in the Qualcomm Atheros WLAN stack (qcacld-2.0), triggered when QCA_NL80211_VENDOR_SUBCMD_SET_TXPOWER_SCALE_DECR_DB carries fewer than 1 byte in the TXPOWER_SCALE_DECR_DB attribute. Affected: Android for MSM, Firefox OS for MSM, and QRD Android devices prior to ...

CVE-2017-14877

CVE-2017-14877 affects the IPA driver in Android for MSM, Firefox OS for MSM, and QRD Android prior to 2017-08-31. Root cause: there is no mutex lock around allocated memory when processing IOCTLs, enabling a use-after-free if IPA_IOC_QUERY_RT_TBL_INDEX and IPA_IOC_DEL_RT_RULE are issued concurre...

CVE-2017-15852

CVE-2017-15852 is an information-disclosure vulnerability affecting Qualcomm MSM camera components, specifically an ISPIF/base address exposure in the camera driver (Framebuffer path referenced in Pixel/Qualcomm mappings). The NVD entry describes an information leak of the ISPIF base address that...

CVE-2017-14891

CVE-2017-14891 affects the KGSL driver function _gpuobj_map_useraddr() in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-10-12. The issue is an uninitialized variable that can leak stack contents, causing information disclosure. The vulnerability is tied to the kernel/driver sta...

CVE-2017-14876

In msmispifconfigstereo in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-06-21, the parameter params-entriesi.vfeintf comes from userspace without any bounds check which could potentially result in a kernel out-of-bounds write...

CVE-2017-9692

CVE-2017-9692 is tracked in multiple sources with a concrete reference to the Graphics driver in Google device updates, listing DoS (local) as the vulnerability type. The issue is described as a NULL pointer dereference that can occur when an atomic commit is issued on a writeback panel with a NU...

CVE-2017-17771

CVE-2017-17771 affects the MSM camera path (msm_isp_prepare_v4l2_buf) in Android for MSM, Firefox OS for MSM, and QRD Android prior to 2017-02-12. The issue is an array out-of-bounds condition in the buffer preparation routine. The root cause is within the Qualcomm MSM media/camera stack, impacti...

CVE-2017-14875

CVE-2017-14875 describes a heap overread in the ioctl handler VIDIOC_MSM_ISP_DUAL_HW_LPM_MODE used by Android for MSM, Firefox OS for MSM, and QRD Android prior to 2017-05-23. The provided documents name the affected environments and the general vulnerability class but do not provide further root...

CVE-2017-15826

The CVE-2017-15826 entry describes a race condition in the MDSS rotator used in Android for MSM, Firefox OS for MSM, and QRD Android prior to 2017-10-20, potentially enabling a double-free when two threads free the same perf structures. The NVD entry confirms a LOCAL attack with medium complexity...