Design/Logic Flaw

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, due to the lack of a range check on the array index into the WMI descriptor pool, arbitrary address execution may potentially occur in the process mgmt completion handler...

Input validation

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for respevent-vdevid in wmaunifiedbcntxstatuseventhandler, which is received from firmware, leads to potential out of bounds memory read...

Buffer overflow

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for vdevmap in wmatbttoffsetupdateeventhandler, which is received from firmware, leads to potential buffer overwrite and out of bounds memory read...

Input validation

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for vent-vdevid in wmaactionframefiltermaceventhandler, which is received from firmware, leads to arbitrary code execution...

Buffer overflow

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for wmievent-numvdevmacentries in wmapdevsethwmoderespevthandler, which is received from firmware, leads to potential buffer overflow...

CVE-2017-11082

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, due to a race condition in a firmware loading routine, a buffer overflow could potentially occur if multiple user space threads try to update the WLAN firmware file through sysfs...

CVE-2017-18054

CVE-2017-18054 describes a buffer overflow risk in Qualcomm WMA within Android CAF builds, caused by improper input validation for num_vdev_mac_entries in wma_pdev_hw_mode_transition_evt_handler() and the value received from firmware. The vulnerability affects Android for MSM, Firefox OS for MSM,...

CVE-2017-18061

CVE-2017-18061 affects Android for MSM, Firefox OS for MSM, and QRD Android builds using CAF Linux kernel. The vulnerability stems from a potential buffer overflow when processing an AOA (Android Open Accessory) measurement event from WIGIG firmware in wil_aoa_evt_meas(), with Wil6210 as the rela...

CVE-2018-3560

CVE-2018-3560 describes a double-free in the Android sound path. Affected products include Android for MSM, Firefox OS for MSM, and QRD Android with CAF Linux-kernel branches. The root cause is a double-free in the Audio Driver when opening a sound compression device, leading to potential misuse ...

CVE-2017-15833

CVE-2017-15833 affects Android on MSM builds (and related Firefox OS for MSM, QRD Android) with CAF Linux kernel, where untrusted pointer dereference in update_userspace_power() within the power driver can lead to information exposure. The description consistently links this issue to Qualcomm pow...

CVE-2017-11074

CVE-2017-11074 affects Qualcomm WLAN in Android on MSM platforms (CAF-based kernels) via an obsolete set/reset ssid hotlist API in the WLAN stack. Root cause: legacy API left in kernel/UI interfaces enabling privilege escalation. Impact: as per CVSS, high confidentiality, integrity, and availabil...

CVE-2017-18051

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for event-vdevid in wmarcpieventhandler, which is received from firmware, leads to potential out of bounds memory read...

CVE-2017-18060

CVE-2017-18060 affects Qualcomm WLAN within Android on MSM devices (e.g., Android for MSM, CAF-based/Linux kernel stacks). The root cause is improper input validation for resp_event->vdev_id inside wma_unified_bcntx_status_event_handler(), as received from firmware, leading to potential out-of...

CVE-2017-18051

CVE-2017-18051 affects Android for MSM, Firefox OS for MSM, and QRD Android builds based on CAF Linux kernel. The root cause is improper input validation of event->vdev_id in wma_rcpi_event_handler() (received from firmware), which can lead to an out-of-bounds memory read. This vulnerability i...

CVE-2017-15831

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the function wmandpendindicationeventhandler, there is no input validation check on a eventinfo value coming from firmware, which can cause an integer overflow and then leads to...

CVE-2018-3561

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a race condition in diagioctllsmdeinit leads to a Use After Free condition...

CVE-2017-15834

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, race condition in diagdbgfsreaddcistats, while accessing diagdbgfsdcidataindex, causes potential heap overflow...

CVE-2017-14887

CVE-2017-14887: In Android for MSM, Firefox OS for MSM, QRD Android, and all CAF Linux-kernel Android releases, processing messages of type eWNI_SME_MODIFY_ADDITIONAL_IES can trigger an integer overflow that may lead to a heap buffer overflow. Affected platforms include Android for MSM and relate...

CVE-2017-15831

CVE-2017-15831 describes a vulnerability in Android for MSM, Firefox OS for MSM, and QRD Android builds using CAF Linux, where the function wma_ndp_end_indication_event_handler() performs no input validation on an event_info value from firmware. This can cause an integer overflow and potentially ...

CVE-2017-18066

CVE-2017-18066 affects Android for MSM, Firefox OS for MSM, and QRD Android builds with CAF Linux kernels. The issue is a use-after-free in msm_core_ioctl(), a memory-management bug in MSM CORE, leading to potential elevation of privilege or other memory-corruption impacts. The CVSS data (3.0) in...