CVE-2017-15842

Buffer might get used after it gets freed due to unlocking the mutex before freeing the buffer in all Android releases from CAF Android for MSM, Firefox OS for MSM, QRD Android using the Linux Kernel...

CVE-2017-15843

Due to a race condition in a bus driver, a double free in msmbusfloorvotecontext can potentially occur in all Android releases from CAF Android for MSM, Firefox OS for MSM, QRD Android using the Linux Kernel...

CVE-2017-15857

In the camera driver, an out-of-bounds access can occur due to an error in copying region params from user space in all Android releases from CAF Android for MSM, Firefox OS for MSM, QRD Android using the Linux Kernel...

CVE-2018-5848

In the function wmisetie, the length validation code does not handle unsigned integer overflow properly. As a result, a large value of the 'ielen' argument can cause a buffer overflow in all Android releases from CAF Android for MSM, Firefox OS for MSM, QRD Android using the Linux Kernel...

CVE-2017-18070

In wmandpendresponseeventhandler, the variable lenendrsp is a uint32 which can be overflowed if the value of variable "event-numndpendrspperndilist" is very large which can then lead to a heap overwrite of the heap object endrsp in all Android releases from CAF Android for MSM, Firefox OS for MSM...

CVE-2018-5844

In the video driver function setoutputbuffers, binfo can be accessed after being freed in a failure scenario in all Android releases from CAF Android for MSM, Firefox OS for MSM, QRD Android using the Linux Kernel...

Design/Logic Flaw

Early or late retirement of rotation requests can result in a Use After Free condition in all Android releases from CAF Android for MSM, Firefox OS for MSM, QRD Android using the Linux Kernel...

Buffer overflow

Buffer over flow can occur while processing a HTTT2HMSGTYPETXCOMPLIND message with an out-of-range nummsdus value in all Android releases from CAF Android for MSM, Firefox OS for MSM, QRD Android using the Linux Kernel...

CVE-2018-3571

In the KGSL driver in all Android releases from CAF Android for MSM, Firefox OS for MSM, QRD Android using the Linux Kernel, a Use After Free condition can occur when printing information about sparse memory allocations...

Input validation

In the function wmapdevdivinfoevthandler in all Android releases from CAF Android for MSM, Firefox OS for MSM, QRD Android using the Linux Kernel, there is no upper bound check on the value event-numchainsvalid received from firmware which can lead to a buffer overwrite of the fixed size...

Design/Logic Flaw

In the video driver function setoutputbuffers, binfo can be accessed after being freed in a failure scenario in all Android releases from CAF Android for MSM, Firefox OS for MSM, QRD Android using the Linux Kernel...

CVE-2018-5843

In the function wmapdevdivinfoevthandler in all Android releases from CAF Android for MSM, Firefox OS for MSM, QRD Android using the Linux Kernel, there is no upper bound check on the value event-numchainsvalid received from firmware which can lead to a buffer overwrite of the fixed size...

CVE-2018-5847

Early or late retirement of rotation requests can result in a Use After Free condition in all Android releases from CAF Android for MSM, Firefox OS for MSM, QRD Android using the Linux Kernel...

DEBIAN-CVE-2018-5848

In the function wmisetie, the length validation code does not handle unsigned integer overflow properly. As a result, a large value of the 'ielen' argument can cause a buffer overflow in all Android releases from CAF Android for MSM, Firefox OS for MSM, QRD Android using the Linux Kernel...

CVE-2018-3576

improper validation of array index in WiFi driver function sapInterferenceRssiCount leads to array out-of-bounds access in all Android releases from CAF Android for MSM, Firefox OS for MSM, QRD Android using the Linux Kernel...

CVE-2018-5849

Due to a race condition in the QTEECOM driver in all Android releases from CAF Android for MSM, Firefox OS for MSM, QRD Android using the Linux Kernel, when more than one HLOS client loads the same TA, a Use After Free condition can occur...

CVE-2017-15842

CVE-2017-15842 describes a use-after-free vulnerability in Android CAF/Linux kernel code where a mutex is unlocked before freeing the buffer, allowing potential reuse of the freed memory. The issue affects all Android releases using CAF components (Android for MSM, Firefox OS for MSM, QRD Android...

CVE-2018-5844

CVE-2018-5844 describes a use-after-free in the Qualcomm video driver’s set_output_buffers() where binfo can be accessed after it is freed in a failure path across CAF Android for MSM, Firefox OS for MSM, and QRD Android (Linux kernel). The vulnerability affects the video driver component and has...

CVE-2017-18070

In wmandpendresponseeventhandler, the variable lenendrsp is a uint32 which can be overflowed if the value of variable "event-numndpendrspperndilist" is very large which can then lead to a heap overwrite of the heap object endrsp in all Android releases from CAF Android for MSM, Firefox OS for MSM...

CVE-2018-3572

While processing a DSP buffer in an audio driver's event handler, an index of a buffer is not checked before accessing the buffer in all Android releases from CAF Android for MSM, Firefox OS for MSM, QRD Android using the Linux Kernel...