CVE-2018-11818

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, LUT configuration is passed down to driver from userspace via ioctl. Simultaneous update from userspace while kernel drivers are updating LUT registers can lead to race condition...

CVE-2018-11276

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, double free of memory allocation is possible in Kernel when it explicitly tries to free that memory on driver probe failure, since memory allocated is automatically freed on probe...

CVE-2018-11843

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, lack fo check on return value in WMA response handler can lead to potential use after free...

CVE-2018-11278

CVE-2018-11278 affects CAF Venus HW in Android for MSM, Firefox OS for MSM, and QRD Android builds. The vulnerability occurs when Venus HW decodes input bit stream buffers: it searches for a start code, and if the start code is not found in the entire buffer, the implementation may over-fetch bey...

CVE-2018-11280

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, while processing user-space there is no size validation of the NAT entry input. If the user input size of the NAT entry is greater than the max allowed size, memory exhaustion will occur...

CVE-2018-11274

CVE-2018-11274 is documented in the Pixel Security Bulletin under Qualcomm components (Audio). The entry classifies it as a moderate-impact audio buffer overflow affecting Qualcomm Audio; no exploitation details are provided in the supplied documents. The bulletin notes security patch levels of 2...

CVE-2018-11295

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, WMA handler carries a fixed event data from the firmware to the host . If the length and anqp length from this event data exceeds the max length, an OOB write would happen...

CVE-2018-11836

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, improper length check can lead to out-of-bounds access in WLAN function...

CVE-2018-11274

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, buffer overflow may occur when payload size is extremely large...

CVE-2018-11286

CVE-2018-11286 pertains to CAF-based Android releases (Android for MSM, Firefox OS for MSM, QRD Android) running the Linux kernel, where a use-after-free occurs when accessing the global variable debug_client in a multi-threaded context. The issue is a memory-management bug in the kernel-componen...

CVE-2018-11302

CVE-2018-11302 corresponds to a WLAN buffer overflow issue described in Qualcomm CAF Android variants (Android for MSM, Firefox OS for MSM, QRD Android) where input from userspace could be copied into a kernel buffer without proper validation. The CVE is listed under the Qualcomm component mappin...

CVE-2018-11299

CVE-2018-11299 affects CAF WLAN host driver in Android/Linux kernel: when WLAN firmware does not fill the vdev id correctly in stats events, the driver may access an interface array without proper bounds checking, causing invalid memory access and potentially kernel panic or page fault. Connected...

CVE-2018-11293

CVE-2018-11293 affects Qualcomm WLAN Host in Android variants built on CAF Linux kernel (Android for MSM, Firefox OS for MSM, QRD Android). The issue arises in wma_ndp_confirm_event_handler and wma_ndp_indication_event_handler where ndp_cfg_len and num_ndp_app_info are taken from firmware without...

CVE-2018-11278

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, Venus HW searches for start code when decoding input bit stream buffers. If start code is not found in entire buffer, there is over-fetch beyond allocation length. This leads to page fault...

CVE-2018-11273

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, 'voicesvcdev' is allocated as a device-managed resource. If error 'cdevallocerr' occurs, 'devicedestroy' will free all associated resources, including 'voicesvcdev' leading to a double free...

CVE-2018-11863

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, lack of check of input received from firmware to calculate the length of WMA roam synch buffer can lead to buffer overwrite during memcpy...

CVE-2018-11868

CVE-2018-11868 describes a buffer overflow in the nan response event handler due to lack of length validation for values received from firmware. The issue affects Android releases (Android for MSM, Firefox OS for MSM, QRD Android) derived from CAF using the Linux kernel, with the root cause being...

CVE-2018-11827

CVE-2018-11827 affects CAF/Android builds (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux kernel. The issue: improper validation of an array index in the WMA roam synchronization handler can cause an out-of-bounds write. This is tied to Qualcomm WLAN/driver components in the af...

CVE-2017-15825

CVE-2017-15825 is associated with Qualcomm component BIOS/Boot in Android CAF builds using the Linux kernel. The vulnerability involves an out-of-bounds memory access during GPT update processing, described as a local issue with partial confidentiality, integrity, and availability impact. The CVE...

CVE-2018-11298

CVE-2018-11298 concerns a buffer overflow in Qualcomm WLAN Host within Android CAF builds using the Linux kernel. During processing of the SET_PASSPOINT_LIST command, the realm string passed from upper layers is not guaranteed to be NULL terminated, allowing strlen to determine its length and con...