CVE-2017-15844

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, while processing the function for writing device values into flash, uninitialized memory can be written to flash...

Design/Logic Flaw

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, lack of check on input received to calculate the buffer length can lead to out of bound write to kernel stack...

Code injection

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, in wmandpconfirmeventhandler and wmandpindicationeventhandler, ndpcfg len and numndpappinfo is from fw. If they are not checked, it may cause buffer over-read once the value is too large...

Double free

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, 'voicesvcdev' is allocated as a device-managed resource. If error 'cdevallocerr' occurs, 'devicedestroy' will free all associated resources, including 'voicesvcdev' leading to a double free...

Buffer overflow

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, lack of check of input received from userspace before copying into buffer can lead to potential array overflow in WLAN...

Command injection

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, while processing the WLAN driver command ioctl a temporary buffer used to construct the reply message may be freed twice...

Design/Logic Flaw

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, lack fo check on return value in WMA response handler can lead to potential use after free...

Buffer overflow

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, while processing SETPASSPOINTLIST vendor command HDD does not make sure that the realm string that gets passed by upper-layer is NULL terminated. This may lead to buffer overflow as strlen is...

Design/Logic Flaw

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, during wlan association, driver allocates memory. In case the mem allocation fails driver does a mem free though the memory was not allocated...

Design/Logic Flaw

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, when flashing image using FastbootLib if size is not divisible by block size, information leak occurs...

Integer overflow

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, lack of check on integer overflow while calculating memory can lead to Buffer overflow in WLAN ext scan handler...

Buffer overflow

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, a potential buffer over flow could occur while processing the ndp event due to lack of check on the message length...

Buffer overflow

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, while processing a message from firmware in WLAN handler, a buffer overwrite can occur...

Design/Logic Flaw

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, while processing the function for writing device values into flash, uninitialized memory can be written to flash...

Design/Logic Flaw

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, when WLAN FW has not filled the vdev id correctly in stats events then WLAN host driver tries to access interface array without proper bound check which can lead to invalid memory access and ...

Integer overflow

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, while loading a user application in qseecom, an integer overflow could potentially occur if the application partition size is rounded up to pagesize...

Design/Logic Flaw

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, callback executed from the other thread has freed memory which is also used in wlan function and may result in to a "Use after free" scenario...

Input validation

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, WLAN handler indication from the firmware gets the information for 4 access categories. While processing this information only the first 3 AC information is copied due to the improper...

CVE-2018-11280

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, while processing user-space there is no size validation of the NAT entry input. If the user input size of the NAT entry is greater than the max allowed size, memory exhaustion will occur...

CVE-2018-11278

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, Venus HW searches for start code when decoding input bit stream buffers. If start code is not found in entire buffer, there is over-fetch beyond allocation length. This leads to page fault...