Buffer overflow

While processing the QCANL80211VENDORSUBCMDSETTXPOWERSCALEDECRDB vendor command, in which attribute QCAWLANVENDORATTRTXPOWERSCALEDECRDB contains fewer than 1 byte, in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-08-11 a buffer overrun occurs...

Buffer overflow

In the function wmaunifiedpowerdebugstatseventhandler in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-10-18, if the value parambuf-numdebugregister received from the FW command buffer is close to max of uint32, then the computation performed using this variable to calculate...

Race condition

There is a race condition in Android for MSM, Firefox OS for MSM, and QRD Android that allows to access to already free'd memory in the debug message output functionality contained within the mobicore driver...

CVE-2017-15852

Information leak of the ISPIF base address in Android for MSM, Firefox OS for MSM, and QRD Android can occur in the camera driver...

Improper access control

In the function msmpcmhwparams in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-09-19, the return value of q6asmopensharedio is not checked properly potentially leading to a possible dangling pointer access...

CVE-2017-17771

In msmisppreparev4l2buf in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-02-12, an array out of bounds can occur...

CVE-2017-17769

Information leakage in Android for MSM, Firefox OS for MSM, and QRD Android can occur in the audio driver...

CVE-2017-9691

There is a race condition in Android for MSM, Firefox OS for MSM, and QRD Android that allows to access to already free'd memory in the debug message output functionality contained within the mobicore driver...

Heap overflow

In the handler for the ioctl command VIDIOCMSMISPDUALHWLPMMODE in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-05-23, a heap overread vulnerability exists...

Out-of-bounds

In msmispifconfigstereo in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-06-21, the parameter params-entriesi.vfeintf comes from userspace without any bounds check which could potentially result in a kernel out-of-bounds write...

CVE-2017-9692

CVE-2017-9692 is tracked in multiple sources with a concrete reference to the Graphics driver in Google device updates, listing DoS (local) as the vulnerability type. The issue is described as a NULL pointer dereference that can occur when an atomic commit is issued on a writeback panel with a NU...

CVE-2017-14891

CVE-2017-14891 affects the KGSL driver function _gpuobj_map_useraddr() in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-10-12. The issue is an uninitialized variable that can leak stack contents, causing information disclosure. The vulnerability is tied to the kernel/driver sta...

CVE-2017-17771

CVE-2017-17771 affects the MSM camera path (msm_isp_prepare_v4l2_buf) in Android for MSM, Firefox OS for MSM, and QRD Android prior to 2017-02-12. The issue is an array out-of-bounds condition in the buffer preparation routine. The root cause is within the Qualcomm MSM media/camera stack, impacti...

CVE-2017-9691

There is a race condition in Android for MSM, Firefox OS for MSM, and QRD Android that allows to access to already free'd memory in the debug message output functionality contained within the mobicore driver...

CVE-2017-15826

The CVE-2017-15826 entry describes a race condition in the MDSS rotator used in Android for MSM, Firefox OS for MSM, and QRD Android prior to 2017-10-20, potentially enabling a double-free when two threads free the same perf structures. The NVD entry confirms a LOCAL attack with medium complexity...

CVE-2017-9692

When an atomic commit is issued on a writeback panel with a NULL outputlayer parameter in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-06-03, a NULL pointer dereference may potentially occur...

CVE-2017-17771

In msmisppreparev4l2buf in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-02-12, an array out of bounds can occur...

CVE-2017-15852

CVE-2017-15852 is an information-disclosure vulnerability affecting Qualcomm MSM camera components, specifically an ISPIF/base address exposure in the camera driver (Framebuffer path referenced in Pixel/Qualcomm mappings). The NVD entry describes an information leak of the ISPIF base address that...

CVE-2017-14876

The CVE-2017-14876 vulnerability affects Android for MSM, Firefox OS for MSM, and QRD Android prior to 2017-06-21. The root cause is a lack of bounds checking on params->entries[i].vfe_intf in msm_ispif_config_stereo(), which can lead to a kernel out-of-bounds write. Exploitation status is not...

CVE-2017-15859

CVE-2017-15859 is a buffer overrun in the Qualcomm Atheros WLAN stack (qcacld-2.0), triggered when QCA_NL80211_VENDOR_SUBCMD_SET_TXPOWER_SCALE_DECR_DB carries fewer than 1 byte in the TXPOWER_SCALE_DECR_DB attribute. Affected: Android for MSM, Firefox OS for MSM, and QRD Android devices prior to ...