CVE-2018-11886

CVE-2018-11886 affects Qualcomm WLAN host in Android CAF/linux-kernel WLAN stack. Root cause: missing validation when calculating MPDU data length leads to an integer overflow, then a buffer overflow in the WLAN function. Impact per sources is consistent with local, low-privilege exploitation and...

CVE-2018-3574

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, userspace can request ION cache maintenance on a secure ION buffer for which the IONFLAGSECURE ion flag is not set and cause the kernel to attempt to perform cache maintenance on memory which...

CVE-2018-11894

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, while processing preferred network offload scan results integer overflow may lead to buffer overflow when large frame length is received from FW...

CVE-2018-11889

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, when requesting rssi timeout, access invalid memory may occur since local variable 'context' stack data of wlan function is free...

CVE-2018-11903

CVE-2018-11903 affects CAF Android builds (Android for MSM, Firefox OS for MSM, QRD Android) that use the Linux kernel. The vulnerability arises from a lack of length validation for a value received from a caller function that is used as an index into WMA interfaces, enabling an out-of-bounds wri...

CVE-2018-11898

CVE-2018-11898 affects Qualcomm WLAN host components in CAF Android builds (Android for MSM/CAF Linux kernel). The issue is an out-of-bounds read when processing a start BSS request if the SSID length exceeds the maximum, leading to potential memory access violations. The NVD entry and related re...

CVE-2018-11902: Improper Validation of Array Index

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, lack of length validation check for value received from firmware can lead to OOB access in WLAN HOST...

PT-2018-10898

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue arises from asynchronous callbacks receiving a pointer to a caller's local variable. If the caller returns early, for example due to a timeout, the callback will dereference an...

CVE-2018-11878: Improper Restriction of Operations within the Bounds of a Memory Buffer

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, possibility of invalid memory access while processing driver command in WLAN function...

CVE-2018-11893: Improper Restriction of Operations within the Bounds of a Memory Buffer

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, while processing vendor scan request, when input argument - length of request IEs is greater than maximum can lead to a buffer overflow...

CVE-2018-11852

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, improper check In the WMA API for the inputs received from the firmware and then fills the same to the host structure will lead to OOB write...

CVE-2018-11860

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, a potential buffer over flow could occur while processing the ndp event due to lack of check on the message length...

CVE-2018-11868

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, lack of length validation check for value received from firmware can lead to buffer overflow in nan response event handler...

CVE-2018-11843

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, lack fo check on return value in WMA response handler can lead to potential use after free...

CVE-2018-11826

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, lack of check on integer overflow while calculating memory can lead to Buffer overflow in WLAN ext scan handler...

CVE-2018-11297

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, a buffer over-read can occur In the WMA NDP event handler functions due to lack of validation of input value eventinfo which is received from FW...

CVE-2018-11293

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, in wmandpconfirmeventhandler and wmandpindicationeventhandler, ndpcfg len and numndpappinfo is from fw. If they are not checked, it may cause buffer over-read once the value is too large...

CVE-2018-11294

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, WLAN handler indication from the firmware gets the information for 4 access categories. While processing this information only the first 3 AC information is copied due to the improper...

CVE-2018-11295

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, WMA handler carries a fixed event data from the firmware to the host . If the length and anqp length from this event data exceeds the max length, an OOB write would happen...

CVE-2018-11296

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, while processing a message from firmware in WLAN handler, a buffer overwrite can occur...