CVE-2018-11265

CVE-2018-11265 concerns a buffer overflow in Qualcomm MProc when Android CAF/Linux kernel handles log_buf with a uint64_t; the log_buf pointer may access memory beyond bounds when incremented in memcpy. Multiple sources (NVD entry and CNVD/PRION-style mappings) associate this with Android on Pixe...

CVE-2018-11265

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, possible buffer overflow while incrementing the logbuf of type uint64t in memcpy function, since the logbuf pointer can access the memory beyond the size to store the data after pointer...

CVE-2017-15825

CVE-2017-15825 is associated with Qualcomm component BIOS/Boot in Android CAF builds using the Linux kernel. The vulnerability involves an out-of-bounds memory access during GPT update processing, described as a local issue with partial confidentiality, integrity, and availability impact. The CVE...

CVE-2018-11275

CVE-2018-11275 affects Qualcomm/CAF Android boot components (Bootloader) across Android for MSM variants. The issue arises during image flashing via FastbootLib when the payload size is not divisible by the block size, causing an information disclosure. The vulnerability is characterized as a loc...

CVE-2018-11280

CVE-2018-11280 affects Android CAF builds (Linux kernel in Android for MSM, Firefox OS for MSM, QRD Android). The vulnerability arises from missing size validation for NAT entry input during user-space processing, which could allow memory exhaustion when input size exceeds the maximum. Impact is ...

CVE-2018-11826

CVE-2018-11826 causes a buffer overflow in the WLAN ext scan handler due to a missing check for integer overflow during memory size calculations in CAF Android/Linux kernel components. Affected: Qualcomm WLAN HOST (Android CAF stack). The issue is documented across multiple sources (NVD entry and...

CVE-2018-11869

CVE-2018-11869 affects Android-family releases used on CAF/Linux kernels. The issue is a lack of length validation for a value received from firmware, which can cause a buffer overflow in the WMA handler . The vulnerability is described as local with potential complete impact on confidentiality, ...

CVE-2018-11296

CVE-2018-11296 is a Qualcomm WLAN Host buffer overflow affecting Android on Pixel/Nexus devices, caused by a buffer overwrite while processing a firmware message in the WLAN handler. The vulnerability is in the Qualcomm WLAN Host within CAF/Linux-based builds. Impact is memory corruption potentia...

CVE-2018-11273

The CVE-2018-11273 entry describes a double-free in voice_svc_dev when CAF’s Linux kernel device allocation hits cdev_alloc_err and device_destroy frees all resources. Affected are Android for MSM, Firefox OS for MSM, and QRD Android builds using CAF’s kernel. The root cause is that voice_svc_dev...

CVE-2018-11298

CVE-2018-11298 concerns a buffer overflow in Qualcomm WLAN Host within Android CAF builds using the Linux kernel. During processing of the SET_PASSPOINT_LIST command, the realm string passed from upper layers is not guaranteed to be NULL terminated, allowing strlen to determine its length and con...

CVE-2018-11868

CVE-2018-11868 describes a buffer overflow in the nan response event handler due to lack of length validation for values received from firmware. The issue affects Android releases (Android for MSM, Firefox OS for MSM, QRD Android) derived from CAF using the Linux kernel, with the root cause being...

CVE-2018-11827

CVE-2018-11827 affects CAF/Android builds (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux kernel. The issue: improper validation of an array index in the WMA roam synchronization handler can cause an out-of-bounds write. This is tied to Qualcomm WLAN/driver components in the af...

CVE-2018-11868

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, lack of length validation check for value received from firmware can lead to buffer overflow in nan response event handler...

CVE-2018-11281

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, while calling IPAIOCMDFYRTRULE IPA IOCTL, header entry is not checked before use. If IPAIOCMDFYRTRULE IOCTL called for header entries formerly deleted, a Use after free condition will occur...

CVE-2018-11270

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, memory allocated with devmkzalloc is automatically released by the kernel if the probe function fails with an error code. This may result in data corruption...

CVE-2018-11852

CVE-2018-11852 affects Qualcomm WLAN host components used in Android (CAF Qualcomm WLAN stack). The vulnerability stems from an improper check in the WMA API for inputs received from firmware, which can cause an out-of-bounds write to the host structure. According to the Pixel security bulletin, ...

CVE-2018-11836

CVE-2018-11836 affects Qualcomm WLAN HOST components in CAF Linux kernel builds for Android (Android for MSM, etc.). The issue is an improper length check that can cause out-of-bounds access in WLAN, enabling local, low-privilege exploitation with no user interaction. Documented impact is high (C...

CVE-2018-11843

CVE-2018-11843 affects Qualcomm WLAN host components; the issue is use-after-free caused by missing return-value checks in the WMA vdev start/response path. Documented as High severity with local attack vector in Qualcomm/Android bulletins; patches are available in the 2020-01 Android security bu...

CVE-2018-11293

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, in wmandpconfirmeventhandler and wmandpindicationeventhandler, ndpcfg len and numndpappinfo is from fw. If they are not checked, it may cause buffer over-read once the value is too large...

CVE-2018-11842

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, during wlan association, driver allocates memory. In case the mem allocation fails driver does a mem free though the memory was not allocated...