CVE-2018-11903

CVE-2018-11903 affects CAF Android builds (Android for MSM, Firefox OS for MSM, QRD Android) that use the Linux kernel. The vulnerability arises from a lack of length validation for a value received from a caller function that is used as an index into WMA interfaces, enabling an out-of-bounds wri...

CVE-2018-11852

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, improper check In the WMA API for the inputs received from the firmware and then fills the same to the host structure will lead to OOB write...

CVE-2018-11827

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, improper validation of array index in WMA roam synchronization handler can lead to OOB write...

CVE-2018-11295

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, WMA handler carries a fixed event data from the firmware to the host . If the length and anqp length from this event data exceeds the max length, an OOB write would happen...

Design/Logic Flaw

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, WMA handler carries a fixed event data from the firmware to the host . If the length and anqp length from this event data exceeds the max length, an OOB write would happen...

Input validation

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, improper validation of array index in WMA roam synchronization handler can lead to OOB write...

CVE-2018-11827

CVE-2018-11827 affects CAF/Android builds (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux kernel. The issue: improper validation of an array index in the WMA roam synchronization handler can cause an out-of-bounds write. This is tied to Qualcomm WLAN/driver components in the af...

CVE-2018-11827

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, improper validation of array index in WMA roam synchronization handler can lead to OOB write...

CVE-2018-11852

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, improper check In the WMA API for the inputs received from the firmware and then fills the same to the host structure will lead to OOB write...

CVE-2018-11852

CVE-2018-11852 affects Qualcomm WLAN host components used in Android (CAF Qualcomm WLAN stack). The vulnerability stems from an improper check in the WMA API for inputs received from firmware, which can cause an out-of-bounds write to the host structure. According to the Pixel security bulletin, ...

CVE-2018-11295

The CVE-2018-11295 issue affects Qualcomm WLAN Host in Android on Pixel/Nexus devices, tied to the CAF Linux kernel WMA handler where a fixed event data length from firmware can trigger an out-of-bounds write if length fields exceed the maximum. The Android Pixel bulletin lists CVE-2018-11295 und...

CVE-2018-11295

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, WMA handler carries a fixed event data from the firmware to the host . If the length and anqp length from this event data exceeds the max length, an OOB write would happen...

Design/Logic Flaw

In all Android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the Linux kernel, radioid is received from the FW and is used to access the buffer to copy the radio stats received for each radio from FW. If the radioid received from the FW is greater than or equal to...

CVE-2018-11263

In all Android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the Linux kernel, radioid is received from the FW and is used to access the buffer to copy the radio stats received for each radio from FW. If the radioid received from the FW is greater than or equal to...

CVE-2018-11263

In all Android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the Linux kernel, radioid is received from the FW and is used to access the buffer to copy the radio stats received for each radio from FW. If the radioid received from the FW is greater than or equal to...

CVE-2018-11263

CVE-2018-11263 concerns CAF-derived Android WLAN code in the Linux kernel used on Android for MSM, Firefox OS for MSM, and QRD Android. The issue arises when the radio_id received from the FW is greater than or equal to the maximum, allowing an out-of-bounds write while copying radio stats. The v...

Cross site scripting

In Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel while trying to find out total number of partition via a non zero check, there could be possibility where the 'TotalPart' could cross 'GptHeader-MaxPtCnt' and which could result in OO...

CVE-2018-11262

In Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel while trying to find out total number of partition via a non zero check, there could be possibility where the 'TotalPart' could cross 'GptHeader-MaxPtCnt' and which could result in OO...

CVE-2018-11262

In Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel while trying to find out total number of partition via a non zero check, there could be possibility where the 'TotalPart' could cross 'GptHeader-MaxPtCnt' and which could result in OO...

CVE-2018-11262

CVE-2018-11262 is a critical issue documented in Qualcomm bootloader components (Android bulletin entry) with an associated out-of-bounds write risk in GPT patching caused by the TotalPart count exceeding GPT Header MaxPtCnt. The connected records indicate this CVE affects Qualcomm bootloader in ...