CVE-2017-15830

CVE-2017-15830 affects the Qualcomm SME driver in Android on MSM (CAF Linux kernel lineage). The root cause is improper initialization of the ch_list array index in function sme_set_plm_request(), which can lead to a buffer overflow. The vulnerability is categorized as EoP (elevation of privilege...

CVE-2017-14889

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, due to the lack of a range check on the array index into the WMI descriptor pool, arbitrary address execution may potentially occur in the process mgmt completion handler...

CVE-2017-18050

The CVE-2017-18050 entry affects Android for MSM, Firefox OS for MSM, QRD Android, and CAF-based Android with the Linux kernel. The root cause is improper input validation for vdev_map in wma_tbttoffset_update_event_handler(), which processes data from firmware, risking a buffer overwrite and an ...

CVE-2017-15834

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, race condition in diagdbgfsreaddcistats, while accessing diagdbgfsdcidataindex, causes potential heap overflow...

CVE-2017-18052

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for cmplparams-numreports, parambuf-descids and parambuf-status in wmamgmttxbundlecompletionhandler, which is received from firmware, leads to potential out of...

CVE-2017-18055

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for wmievent-numvdevmacentries in wmapdevsethwmoderespevthandler, which is received from firmware, leads to potential buffer overflow...

CVE-2017-18052

CVE-2017-18052 affects Qualcomm WLAN in Android devices (CAF Linux kernel line) via the wma_mgmt_tx_bundle_completion_handler() function. The root cause is improper input validation for cmpl_params->num_reports, param_buf->desc_ids, and param_buf->status received from firmware, leading t...

CVE-2017-18055

The CVE-2017-18055 issue is a buffer overflow in Qualcomm WLAN/Wma. Root cause: improper input validation of wmi_event->num_vdev_mac_entries in wma_pdev_set_hw_mode_resp_evt_handler(), as the event is received from firmware. Affected software/hardware: Android on MSM platforms (CAF/Linux kerne...

CVE-2017-15834

CVE-2017-15834: A race condition in Qualcomm Diagchar's diag_dbgfs_read_dcistats while accessing diag_dbgfs_dci_data_index in Android for MSM platforms (CAF Linux kernel lineage) can lead to a heap overflow. Affected components include Qualcomm diagchar and kernel subsystems across Android builds...

CVE-2017-11082

CVE-2017-11082 affects Qualcomm WLAN in Android on MSM (and related CAF/Linux kernel builds) where a race condition in the firmware loading routine could lead to a buffer overflow if multiple user-space threads update the WLAN firmware file via sysfs. The root cause is a race in the firmware load...

CVE-2017-18063

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for nloevent in wmanlomatchevthandler, which is received from firmware, leads to potential out of bound memory access...

Buffer overflow

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for p2pnoainfo in wmasendbcnbufll which is received from firmware leads to potential buffer overflow...

Buffer overflow

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation while processing an encrypted authentication management frame in limsendauthmgmtframe leads to buffer overflow...

Buffer overflow

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper buffer length calculation in wmaroamscanfilter leads to buffer overflow...

CVE-2017-15821

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the function wmap2pnoaeventhandler, there is no bound check on a value coming from firmware which can potentially lead to a buffer overwrite...

Design/Logic Flaw

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, when processing a clip with large size values, integer arithmetic overflows, and allocated buffer size will be less than intended buffer size. The following buffer operations will...

CVE-2016-10393

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, when processing a clip with large size values, integer arithmetic overflows, and allocated buffer size will be less than intended buffer size. The following buffer operations will...

CVE-2017-14885

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, wmaunifiedlinkpeerstatseventhandler function has a variable numrates which represents the sum of all the peerstats-numrates. The current behavior in this function is to validate only th...

Buffer overflow

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper message length calculation in oemcmdhandler while processing a WLANNLMSGOEM netlink message leads to buffer overread...

CVE-2017-18056

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for vdevid in wmaunifiedbcntxstatuseventhandler which is received from firmware leads to potential out of bounds memory read...