CVE-2017-14892

In the function msmpcmhwparams in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-09-19, the return value of q6asmopensharedio is not checked properly potentially leading to a possible dangling pointer access...

Design/Logic Flaw

In the KGSL driver function gpuobjmapuseraddr in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-10-12, the contents of the stack can get leaked due to an uninitialized variable...

Heap overflow

In the handler for the ioctl command VIDIOCMSMISPDUALHWLPMMODE in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-05-23, a heap overread vulnerability exists...

Code injection

The length of attribute value for STAEXTCAPABILITY in wlanhddchangestation in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-06-06 being less than the actual lenth of StaParams.extncapability results in a read for extra bytes when a memcpy is done from params-extcapab to...

CVE-2017-9691

There is a race condition in Android for MSM, Firefox OS for MSM, and QRD Android that allows to access to already free'd memory in the debug message output functionality contained within the mobicore driver...

CVE-2017-9692

CVE-2017-9692 is tracked in multiple sources with a concrete reference to the Graphics driver in Google device updates, listing DoS (local) as the vulnerability type. The issue is described as a NULL pointer dereference that can occur when an atomic commit is issued on a writeback panel with a NU...

CVE-2017-14883

CVE-2017-14883 affects Android for MSM, Firefox OS for MSM, and QRD Android prior to 2017-10-18. The issue arises in wma_unified_power_debug_stats_event_handler() when FW command buffer’s param_buf->num_debug_register is near the 32‑bit uint max; the calculation for stats_registers_len may ove...

CVE-2017-14891

CVE-2017-14891 affects the KGSL driver function _gpuobj_map_useraddr() in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-10-12. The issue is an uninitialized variable that can leak stack contents, causing information disclosure. The vulnerability is tied to the kernel/driver sta...

CVE-2017-15826

The CVE-2017-15826 entry describes a race condition in the MDSS rotator used in Android for MSM, Firefox OS for MSM, and QRD Android prior to 2017-10-20, potentially enabling a double-free when two threads free the same perf structures. The NVD entry confirms a LOCAL attack with medium complexity...

CVE-2017-15823

In spectralcreatesampmsg in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-10-11, some values from firmware are not properly validated potentially leading to a buffer overflow...

CVE-2017-17771

CVE-2017-17771 affects the MSM camera path (msm_isp_prepare_v4l2_buf) in Android for MSM, Firefox OS for MSM, and QRD Android prior to 2017-02-12. The issue is an array out-of-bounds condition in the buffer preparation routine. The root cause is within the Qualcomm MSM media/camera stack, impacti...

CVE-2017-9691

There is a race condition in Android for MSM, Firefox OS for MSM, and QRD Android that allows to access to already free'd memory in the debug message output functionality contained within the mobicore driver...

CVE-2017-9692

When an atomic commit is issued on a writeback panel with a NULL outputlayer parameter in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-06-03, a NULL pointer dereference may potentially occur...

CVE-2017-9693

CVE-2017-9693 describes a local vulnerability in Android for MSM, Firefox OS for MSM, and QRD Android where the length of the STA_EXT_CAPABILITY attribute value is shorter than StaParams.extn_capability, causing a memcpy from params->ext_capab to StaParams.extn_capability to read extra bytes. ...

CVE-2017-14876

The CVE-2017-14876 vulnerability affects Android for MSM, Firefox OS for MSM, and QRD Android prior to 2017-06-21. The root cause is a lack of bounds checking on params->entries[i].vfe_intf in msm_ispif_config_stereo(), which can lead to a kernel out-of-bounds write. Exploitation status is not...

CVE-2017-15859

CVE-2017-15859 is a buffer overrun in the Qualcomm Atheros WLAN stack (qcacld-2.0), triggered when QCA_NL80211_VENDOR_SUBCMD_SET_TXPOWER_SCALE_DECR_DB carries fewer than 1 byte in the TXPOWER_SCALE_DECR_DB attribute. Affected: Android for MSM, Firefox OS for MSM, and QRD Android devices prior to ...

CVE-2017-17771

In msmisppreparev4l2buf in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-02-12, an array out of bounds can occur...

CVE-2017-14877

While the IPA driver in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-08-31 is processing IOCTL commands there is no mutex lock of allocated memory. If one thread sends an ioctl cmd IPAIOCQUERYRTTBLINDEX while another sends an ioctl cmd IPAIOCDELRTRULE, a use-after-free conditi...

CVE-2017-15852

Information leak of the ISPIF base address in Android for MSM, Firefox OS for MSM, and QRD Android can occur in the camera driver...

CVE-2017-17769

CVE-2017-17769 involves information leakage in the Qualcomm component (MSM audio driver; listed as qdsp6v2 in the Pixel bulletin) affecting Android for MSM and related builds. The vulnerability is an information-disclosure issue with confidentiality impact (NVD CVSS3: HIGH, base 5.5) and is categ...