Buffer overflow

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a buffer overread is observed in wlanhddcfg80211setpmksa when user space application sends PMKID of size less than WLANPMKIDLEN bytes...

Buffer overflow

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, possible buffer overflow or information leak in the functions "smesetfties" and "csrroamissueftpreauthreq" due to incorrect initialization of WEXT callbacks and lack of the checks for...

Integer overflow

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in a qbt1000 ioctl handler, an incorrect buffer size check has an integer overflow vulnerability potentially leading to a buffer overflow...

Design/Logic Flaw

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while flashing UBI image, size is not validated for being smaller than minimum header size causing unintialized data access vulnerability...

Information disclosure

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, the probe requests originated from user's phone contains the information elements which specifies the supported wifi features. This shall impact the user's privacy if someone sniffs the...

Buffer overflow

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the boot loader, a buffer overflow can occur while parsing the splash image...

Buffer overflow

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the kernel driver MDSS, a buffer overflow can occur in HDMI CEC parsing if frame size is out of range...

Design/Logic Flaw

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the function mdssrotatorioctl in the driver /dev/mdssrotator, a Use-After-Free condition can potentially occur due to a fence being installed too early...

Command injection

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing a specially crafted cfg80211 vendor command, a buffer over-read can occur...

CVE-2017-11013

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, countOffset in function UnpackCore is increased for each loop, while there is no boundary check against "pIe-arraybound"...

CVE-2017-11029

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, camera application triggers "user-memory-access" issue as the Camera CPP module Linux driver directly accesses the application provided buffer, which resides in user space. An unchecked...

CVE-2017-11032

The CVE-2017-11032 issue affects Android builds using CAF Linux kernels (Android MSM/CAF variants). It describes a double-free in the service_locator_send_msg() path when kmalloc fails to allocate memory for resp/req pointers, potentially enabling local privilege elevation. Affected components ar...

CVE-2017-11014

CVE-2017-11014 describes a buffer overflow in the Android/CAF/Linux kernel stack when parsing a Measurement Request IE in a Roam Neighbor Action Report. Affected products include Android for MSM, Firefox OS for MSM, and QRD Android with CAF Linux kernel releases. The CVSS data indicates high impa...

CVE-2017-11038

CVE-2017-11038 is a Qualcomm memory-subsystem Elevation of Privilege flaw affecting Android on MSM devices (and CAF-based kernels) where, during boot image header processing, range checks can be bypassed by supplying different header versions. This enables possible local privilege escalation. The...

CVE-2017-11035

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, possible buffer overflow or information leak in the functions "smesetfties" and "csrroamissueftpreauthreq" due to incorrect initialization of WEXT callbacks and lack of the checks for...

CVE-2017-11029

The CVE-2017-11029 issue is a Qualcomm Camera elevation vulnerability in Android on MSM devices. The vulnerability stems from the Camera CPP module Linux driver directly accessing a user-space buffer, with an unchecked ioctl_ptr->len used to copy data into a kernel buffer, enabling kernel memo...

CVE-2017-11092

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the KGSL driver function kgslioctlgpucommand, a Use After Free condition can potentially occur...

CVE-2017-11058

CVE-2017-11058 affects Android on MSM/Qualcomm WLAN (cfg80211 vendor command handling). The issue is a buffer over-read in the WLAN driver, prompting potential information disclosure (confidentiality impact). Affected firmware, per Pixel/Nexus security bulletin, was addressed by the 2017-11-05 pa...

CVE-2017-11017

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while flashing a specially crafted UBI image, it is possible to corrupt memory, or access uninitialized memory...

CVE-2017-11025

CVE-2017-11025 affects Android on MSM (and related CAF/Linux-based Android builds) with a race condition in audio_effects_shared_ioctl() that can lead to memory corruption. The vulnerability is associated with Qualcomm Audio and is categorized in connected sources as an elevation-of-privilege iss...