Buffer overflow

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper buffer length calculation in wmaroamscanfilter leads to buffer overflow...

CVE-2017-14878

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a length variable which is used to copy data has a size of only 8 bits and can be exceeded resulting in a denial of service...

CVE-2017-18063

CVE-2017-18063 affects Android for MSM (CAF Linux kernel) with WLAN firmware; the issue is improper input validation for nlo_event in wma_nlo_match_evt_handler(), which can cause out-of-bounds memory access. Affected products are Android builds for MSM/CAF and related devices using the Linux kern...

CVE-2017-18069

CVE-2017-18069 affects Android for MSM, Firefox OS for MSM, and QRD Android builds that use CAF Linux kernel, where an improper message length calculation in oem_cmd_handler() while processing a WLAN_NL_MSG_OEM netlink message leads to a buffer overread. Public data lists CVSS base scores around ...

CVE-2017-15821

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the function wmap2pnoaeventhandler, there is no bound check on a value coming from firmware which can potentially lead to a buffer overwrite...

CVE-2017-14882

CVE-2017-14882 affects Android for MSM, Firefox OS for MSM, QRD Android, and CAF Linux-kernel builds. The issue stems from processing a VENDOR specific action frame in lim_process_action_vendor_specific(), where the incoming action frame body is length-validated, allowing potential out-of-bounds ...

PT-2018-1123

Name of the Vulnerable Software and Affected Versions Android versions affected versions not specified Description The issue is related to an integer overflow in the Android operating system from the CAF repository. This can be exploited by a remote attacker to cause a buffer overflow in memory...

Integer overflow

In all Qualcomm products with Android releases from CAF using the Linux kernel, multiple values received from firmware are not properly validated in wmagetllstatsextbuf and are used to allocate the sizes of buffers and may be vulnerable to integer overflow leading to buffer overflow...

Design/Logic Flaw

In all Qualcomm products with Android releases from CAF using the Linux kernel, in a KGSL IOCTL handler, a Use After Free Condition can potentially occur...

Stack overflow

In all Qualcomm products with Android releases from CAF using the Linux kernel, while processing an encrypted authentication management frame, a stack buffer overflow may potentially occur...

Race condition

In all Qualcomm products with Android releases from CAF using the Linux kernel, a race condition exists in a GPU Driver which can potentially lead to a Use After Free condition...

CVE-2017-15817

In all Qualcomm products with Android releases from CAF using the Linux kernel, when an access point sends a challenge text greater than 128 bytes, the host driver is unable to validate this potentially leading to authentication failure...

CVE-2017-15820

In all Qualcomm products with Android releases from CAF using the Linux kernel, in a KGSL IOCTL handler, a Use After Free Condition can potentially occur...

CVE-2017-17764

In all Qualcomm products with Android releases from CAF using the Linux kernel, the numfailureinfo value from firmware is not properly validated in wmarxaggrfailureeventhandler so that an integer overflow vulnerability in a buffer size calculation may potentially lead to a buffer overflow...

CVE-2017-17767

In all Qualcomm products with Android releases from CAF using the Linux kernel, the IL client may free a buffer OMX Video Encoder Component and then subsequently access the already freed buffer...

CVE-2017-14884

In all Qualcomm products with Android releases from CAF using the Linux kernel, due to lack of bounds checking on the variable "datalen" from the function WLANQCMBRMcProcessMsg, a buffer overflow may potentially occur in WLANFTMMcProcessMsg...

CVE-2017-15860

In all Qualcomm products with Android releases from CAF using the Linux kernel, while processing an encrypted authentication management frame, a stack buffer overflow may potentially occur...

CVE-2017-15861

In all Qualcomm products with Android releases from CAF using the Linux kernel, in the function wmaroamsyncheventhandler, vdevid is received from firmware and used to access an array without validation...

CVE-2017-14884

In all Qualcomm products with Android releases from CAF using the Linux kernel, due to lack of bounds checking on the variable "datalen" from the function WLANQCMBRMcProcessMsg, a buffer overflow may potentially occur in WLANFTMMcProcessMsg...

CVE-2017-17764

CVE-2017-17764 describes an integer overflow in the firmware-driven buffer-size calculation inside Qualcomm WLAN’s wma_rx_aggr_failure_event_handler() for CAF Android/Linux-kernel builds. The flaw can allow a crafted failure-info value to cause a buffer overflow, enabling local elevation of privi...