Race condition

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a race condition in a multimedia driver can potentially lead to a buffer overwrite...

Improper access control

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, ImsService and the IQtiImsExt AIDL APIs are not subject to access control...

CVE-2017-9698

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improperly specified offset/size values for a submission command could cause a math operation to overflow and could result in an access to arbitrary memory. The combined pointer will...

CVE-2017-11031

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, the VIDIOCGSDEROTATORFENCE ioctl command can be used to cause a Use After Free condition...

Memory corruption

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, there is a memory allocation without a length field validation in the mobicore driver which can result in an undersize buffer allocation. Ultimately this can result in a kernel memory...

CVE-2017-11033

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the coresight-tmc driver, a simultaneous read and enable of the ETR device after changing the buffer size may result in a Use After Free condition of the previous buffer...

Race condition

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the coresight-tmc driver, a simultaneous read and enable of the ETR device after changing the buffer size may result in a Use After Free condition of the previous buffer...

Command injection

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing a specially crafted cfg80211 vendor command, a buffer over-read can occur...

CVE-2017-11016

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, when memory allocation fails while creating a calibration block in createcalblock stale pointers are left uncleared...

CVE-2017-14905

CVE-2017-14905 affects Android on MSM (and related CAF/Linux-kernel-based builds) via a buffer over-read when handling a specially crafted cfg80211 vendor command in the wireless networking stack. The CNVD/CVE records describe this as information disclosure due to a buffer over-read, impacting Qu...

CVE-2017-14896

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, there is a memory allocation without a length field validation in the mobicore driver which can result in an undersize buffer allocation. Ultimately this can result in a kernel memory...

CVE-2017-9703

CVE-2017-9703 is a race condition in a Camera driver on Android for MSM, Firefox OS for MSM, and QRD Android (CAF Linux kernel). This Use-After-Free vulnerability is rated CVSS v3.0 base score 7.0 (HIGH) with LOCAL attack vector, high impact on confidentiality, integrity, and availability; CVSS v...

CVE-2017-14907

CVE-2017-14907 describes a cryptographic weakness in Android for MSM, Firefox OS for MSM, and QRD Android builds aligned with CAF Linux kernel, caused by a flaw in deriving the disk encryption key that reduces cryptographic strength. Publicly documented as a critical encryption bug affecting Qual...

CVE-2017-14898

CVE-2017-14898 affects Qualcomm WLAN in Android builds (Android for MSM, CAF/Linux kernel). The issue is a buffer overrun in QCA_NL80211_VENDOR_SUBCMD_SET_TXPOWER_SCALE handling when QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE is less than 1 byte. Impact per sources includes high confidentiality, integrit...

CVE-2017-14900

CVE-2017-14900 describes a buffer overrun in the WLAN vendor path when the QCA_NL80211_VENDOR_SUBCMD_GET_CHAIN_RSSI is processed and the MAC address attribute contains fewer than 6 bytes. Affected stack includes Android for MSM, Firefox OS for MSM, QRD Android, and CAF Android releases using the ...

CVE-2017-11049

CVE-2017-11049 describes a race condition in a video driver on Android devices (MSM/Qualcomm display stack) that can potentially lead to a buffer overflow. The affected scope includes Android builds for MSM, Firefox OS for MSM, and QRD Android, with CAF Linux kernel-based releases. The issue is c...

CVE-2017-9722

CVE-2017-9722 affects Android for MSM, Firefox OS for MSM, and QRD Android builds using CAF Linux kernels. The vulnerability arises when updating a custom EDID (hdmi_tx_sysfs_wta_edid) and the edid_size (controlled by userspace) is too large, causing a buffer overflow. Connected documents corrobo...

CVE-2017-11042

CVE-2017-11042 affects Android for MSM, Firefox OS for MSM, and QRD Android builds with CAF Linux kernel, where ImsService and IQtiImsExt AIDL APIs lack access control. Root cause: insufficient access restrictions on these ImsService interfaces. Exploitation would be local (CVSS2/3 reflect LOCAL,...

CVE-2017-14901

CVE-2017-14901 describes a buffer overrun in the Qualcomm WLAN driver within Android for MSM/CAF Linux kernel when handling QCA_NL80211_VENDOR_SUBCMD_SET_TXPOWER_SCALE with a TXPOWER_SCALE attribute of fewer than 1 byte. Affected components include Android devices using CAF/Linux kernel implement...

CVE-2017-11049

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in a video driver, a race condition exists which can potentially lead to a buffer overflow...