CVE-2018-5825: Use After Free

In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05, in the kernel IPA driver, a Use After Free condition can occur...

CVE-2017-15837: Out-of-bounds Read

In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05, a policy for the packet pattern attribute NL80211PKTPATOFFSET is not defined which can lead to a buffer over-read in nlagetu32...

CVE-2017-11075: Use After Free

In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05, if cmdpkt and regpkt are called from different userspace threads, a use after free condition can potentially occur in wdspglinkwrite...

CVE-2017-15836: Integer Overflow or Wraparound

In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05, if the firmware sends a service ready event to the host with a large number in the numhwmodes or numphy, then it could result in an...

CVE-2018-3584: Use After Free

In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05, a Use After Free condition can occur in the function rmnetusbctrlinit...

CVE-2017-17770: NULL Pointer Dereference

In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05, in a power driver ioctl handler, an Untrusted Pointer Dereference may potentially occur...

CVE-2018-5822: Improper Restriction of Operations within the Bounds of a Memory Buffer

In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05, compromised WLAN FW can potentially cause a buffer overwrite...

CVE-2018-5821: Out-of-bounds Read

In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05, in function wmawowwakeuphostevent, wakeinfo-vdevid is received from FW and is used directly as array index to access wma-interfaces...

CVE-2018-5824: Improper Restriction of Operations within the Bounds of a Memory Buffer

In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05, while processing HTTT2HMSGTYPERXFLUSH or HTTT2HMSGTYPERXPNIND messages, a buffer overflow can occur if the tid value obtained from the...

CVE-2018-3598: Exposure of Sensitive Information to an Unauthorized Actor

In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05, insufficient validation of parameters from userspace in the camera driver can lead to information leak and out-of-bounds access...

CVE-2017-18147: Improper Input Validation

In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05, in MMCP, a downlink message is not being properly validated...

CVE-2017-15822: Improper Restriction of Operations within the Bounds of a Memory Buffer

In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05, while processing a 802.11 management frame, a buffer overflow may potentially occur...

CVE-2017-14894: Improper Restriction of Operations within the Bounds of a Memory Buffer

In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05, in wmavdevstartresphandler, vdev id is received from firmware as part of WMIVDEVSTARTRESPEVENTID. This vdev id can be greater than max...

CVE-2018-3566: Improper Restriction of Operations within the Bounds of a Memory Buffer

In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05, a buffer overwrite may occur in ProcSetReqInternal due to missing length check...

CVE-2018-3596: Undefined Security Weakness

In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05, legacy code vulnerable after migration has been removed...

CVE-2018-5820: Integer Overflow or Wraparound

In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05, in the function wmatbttoffsetupdateeventhandler, a parameter received from firmware is used to allocate memory for a local buffer and ...

CVE-2018-3599: Use After Free

In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05, while notifying a DCI client, a Use After Free condition can occur...

CVE-2017-15853: Out-of-bounds Read

In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05, while processing PTT commands, pttsocksendmsgtoapp is invoked without validating the packet length. If the packet length is invalid,...

CVE-2018-5828: Improper Restriction of Operations within the Bounds of a Memory Buffer

In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05, in function wmaextscanstartstopeventhandler, vdevid comes from the variable event from firmware and is not properly validated...

CVE-2017-17764

In all Qualcomm products with Android releases from CAF using the Linux kernel, the numfailureinfo value from firmware is not properly validated in wmarxaggrfailureeventhandler so that an integer overflow vulnerability in a buffer size calculation may potentially lead to a buffer overflow...