CVE-2017-14904

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a crafted binder request can cause an arbitrary unmap in MediaServer...

CVE-2017-14902

CVE-2017-14902 describes a race condition in the GLink kernel driver across Android for MSM, Firefox OS for MSM, and QRD Android builds using CAF Linux kernels. The vulnerability is a Use-After-Free in the GLink driver that can potentially allow a local attacker to compromise the device (as indic...

CVE-2017-14909

Technical details about CVE-2017-14909 are not publicly available in the provided documents. Monitor for updates from the connected sources.

CVE-2017-9708

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the camera driver, the function "msmoispowerdown" is called without a mutex and a race condition can occur in variable "regptr" of sub function "msmcameraconfigsinglevreg"...

CVE-2017-9722

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, when updating custom EDID hdmitxsysfswtaedid, if edidsize, which is controlled by userspace, is too large, a buffer overflow occurs...

CVE-2017-9718

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a race condition in a multimedia driver can potentially lead to a buffer overwrite...

Race condition

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the coresight-tmc driver, a simultaneous read and enable of the ETR device after changing the buffer size may result in a Use After Free condition of the previous buffer...

Race condition

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, the VIDIOCGSDEROTATORFENCE ioctl command can be used to cause a Use After Free condition...

Buffer overflow

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing the QCANL80211VENDORSUBCMDSETTXPOWERSCALE vendor command, in which attribute QCAWLANVENDORATTRTXPOWERSCALE contains fewer than 1 byte, a buffer overrun occurs...

Code injection

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, the fd allocated during the getmetadata was not closed even though the buffer allocated to the fd was freed. This resulted in a failure during exit sequence...

Race condition

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a race condition in a multimedia driver can potentially lead to a buffer overwrite...

CVE-2017-11044

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in a KGSL driver function, a race condition exists which can lead to a Use After Free condition...

Buffer overflow

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a buffer overflow can occur while reading firmware logs...

CVE-2017-14900

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing the QCANL80211VENDORSUBCMDGETCHAINRSSI vendor command, in which attribute QCAWLANVENDORATTRMACADDR contains fewer than 6 bytes, a buffer overrun occurs...

Buffer overflow

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing the QCANL80211VENDORSUBCMDSETTXPOWERSCALE vendor command, in which attribute QCAWLANVENDORATTRTXPOWERSCALE contains fewer than 1 byte, a buffer overrun occurs...

Buffer overflow

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, buffer overwrite is possible in fwnamestore if image name is 64 characters...

CVE-2017-14896

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, there is a memory allocation without a length field validation in the mobicore driver which can result in an undersize buffer allocation. Ultimately this can result in a kernel memory...

CVE-2017-11047

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in a graphics driver ioctl handler, the lack of copyfromuser function calls may result in writes to kernel memory...

Design/Logic Flaw

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in a graphics driver ioctl handler, the lack of copyfromuser function calls may result in writes to kernel memory...

Race condition

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the camera driver, the function "msmoispowerdown" is called without a mutex and a race condition can occur in variable "regptr" of sub function "msmcameraconfigsinglevreg"...