CVE-2017-14883: Improper Restriction of Operations within the Bounds of a Memory Buffer

In the function wmaunifiedpowerdebugstatseventhandler in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-10-18, if the value parambuf-numdebugregister received from the FW command buffer is close to max of uint32, then the computation performed using this variable to calculate...

PT-2018-5994

Name of the Vulnerable Software and Affected Versions: Android for MSM versions prior to 2017-10-11 Firefox OS for MSM versions prior to 2017-10-11 QRD Android versions prior to 2017-10-11 Description: The issue arises from improper validation of values from firmware in the spectral create samp m...

PT-2018-5737

Name of the Vulnerable Software and Affected Versions: Android for MSM versions prior to 2017-10-18 Firefox OS for MSM versions prior to 2017-10-18 QRD Android versions prior to 2017-10-18 Description: The issue arises in the wma unified power debug stats event handler function when the param...

PT-2018-5744

Name of the Vulnerable Software and Affected Versions: Android for MSM versions prior to 2017-09-19 Firefox OS for MSM versions prior to 2017-09-19 QRD Android versions prior to 2017-09-19 Description: The issue is related to the function msm pcm hw params where the return value of q6asm open...

PT-2018-8524

Name of the Vulnerable Software and Affected Versions Android for MSM affected versions not specified Firefox OS for MSM affected versions not specified QRD Android affected versions not specified Description The issue is related to a race condition in the debug message output functionality withi...

PT-2018-6568

Name of the Vulnerable Software and Affected Versions: Android for MSM versions prior to 2017-10-03 Firefox OS for MSM versions prior to 2017-10-03 QRD Android versions prior to 2017-10-03 Description: The issue arises from improper validation of the num peers value received from firmware in the...

CVE-2017-17771: Buffer Copy without Checking Size of Input

In msmisppreparev4l2buf in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-02-12, an array out of bounds can occur...

CVE-2017-9691: Concurrent Execution using Shared Resource with Improper Synchronization

There is a race condition in Android for MSM, Firefox OS for MSM, and QRD Android that allows to access to already free'd memory in the debug message output functionality contained within the mobicore driver...

PT-2018-6016

Name of the Vulnerable Software and Affected Versions: Android for MSM affected versions not specified Firefox OS for MSM affected versions not specified QRD Android affected versions not specified Description: The issue is related to an information leak of the ISPIF base address in the camera...

PT-2018-8526

Name of the Vulnerable Software and Affected Versions Android for MSM versions prior to 2017-06-06 Firefox OS for MSM versions prior to 2017-06-06 QRD Android versions prior to 2017-06-06 Description The issue arises when the length of the attribute value for STA EXT CAPABILITY in the wlan hdd...

CVE-2017-15823: Improper Restriction of Operations within the Bounds of a Memory Buffer

In spectralcreatesampmsg in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-10-11, some values from firmware are not properly validated potentially leading to a buffer overflow...

CVE-2017-18061

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, potential buffer overflow can happen when processing AOA measurement event from WIGIG firmware in wilaoaevtmeas...

CVE-2017-18065

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for vent-vdevid in wmaactionframefiltermaceventhandler, which is received from firmware, leads to arbitrary code execution...

Input validation

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for fixparam-vdevid in wmap2ploeventhandler, which is received from firmware, leads to potential out of bounds memory read...

Input validation

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for wowbufpktlen in wmawowwakeuphostevent which is received from firmware leads to potential out of bounds memory read...

Out-of-bounds

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in msmflashsubdevdoioctl of drivers/media/platform/msm/camerav2/sensor/flash/msmflash.c, there is a possible out of bounds read if flashdata.cfgtype is CFGFLASHINIT due to improper inpu...

CVE-2017-18061

CVE-2017-18061 affects Android for MSM, Firefox OS for MSM, and QRD Android builds using CAF Linux kernel. The vulnerability stems from a potential buffer overflow when processing an AOA (Android Open Accessory) measurement event from WIGIG firmware in wil_aoa_evt_meas(), with Wil6210 as the rela...

CVE-2017-15833

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, untrusted pointer dereference in updateuserspacepower function in power leads to information exposure...

CVE-2017-18058

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for wowbufpktlen in wmawowwakeuphostevent which is received from firmware leads to potential out of bounds memory read...

CVE-2017-15830

CVE-2017-15830 affects the Qualcomm SME driver in Android on MSM (CAF Linux kernel lineage). The root cause is improper initialization of the ch_list array index in function sme_set_plm_request(), which can lead to a buffer overflow. The vulnerability is categorized as EoP (elevation of privilege...