PT-2018-10845

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A issue exists in the WLAN driver command ioctl processing, where a temporary buffer used to construct the reply message may be freed twice. This is present in all Android releases from...

PT-2018-10459

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue arises from improper conditional logic used in the WLAN handler to compare with the maximum number of access categories. This logic results in only the first 3 access category ...

PT-2018-10464

Name of the Vulnerable Software and Affected Versions Android for MSM affected versions not specified Firefox OS for MSM affected versions not specified QRD Android affected versions not specified Description The issue arises when the WLAN FW fails to correctly fill the vdev id in stats events,...

PT-2018-10466

Name of the Vulnerable Software and Affected Versions Android for MSM affected versions not specified Firefox OS for MSM affected versions not specified QRD Android affected versions not specified Description The issue is related to a "Use after free" scenario, where a callback executed from...

CVE-2018-11826: Integer Overflow or Wraparound

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, lack of check on integer overflow while calculating memory can lead to Buffer overflow in WLAN ext scan handler...

CVE-2018-11836: Improper Restriction of Operations within the Bounds of a Memory Buffer

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, improper length check can lead to out-of-bounds access in WLAN function...

PT-2018-10468

Name of the Vulnerable Software and Affected Versions Android for MSM affected versions not specified Firefox OS for MSM affected versions not specified QRD Android affected versions not specified Description The issue is related to a lack of input validation from userspace before copying data in...

PT-2018-10461

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A buffer overwrite issue can occur in the WLAN handler while processing a message from firmware. This issue affects Android releases from CAF using the Linux kernel. Recommendations At t...

CVE-2018-11294: Improper Input Validation

In all android releases Android for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, WLAN handler indication from the firmware gets the information for 4 access categories. While processing this information only the first 3 AC information is copied due to the improper...

PT-2018-13830

Name of the Vulnerable Software and Affected Versions TP-Link TL-WR886N versions 6.0 2.3.4 through 7.0 1.1.0 Description An issue allows authenticated attackers to crash router services, including inetd, HTTP, DNS, and UPnP, by sending long JSON data for wireless wlan host 2g bandwidth...

PT-2018-13829

Name of the Vulnerable Software and Affected Versions TP-Link TL-WR886N versions 6.0 2.3.4 through 7.0 1.1.0 Description An issue allows authenticated attackers to crash router services, including inetd, HTTP, DNS, and UPnP, by sending long JSON data for wireless wlan host 2g isolate...

PT-2018-13824

Name of the Vulnerable Software and Affected Versions TP-Link TL-WR886N versions 6.0 2.3.4 through 7.0 1.1.0 Description An issue allows authenticated attackers to crash router services, including inetd, HTTP, DNS, and UPnP, by sending long JSON data for the wlan access name. Recommendations For...

[SECURITY] Fedora 27 Update: wpa_supplicant-2.6-14.fc27

wpasupplicant is a WPA Supplicant for Linux, BSD and Windows with support for WPA and WPA2 IEEE 802.11i / RSN. Supplicant is the IEEE 802.1X/WPA component that is used in the client stations. It implements key negotiation with a WPA Authenticator and it controls the roaming and IEEE 802.11...

[SECURITY] Fedora 28 Update: wpa_supplicant-2.6-17.fc28

wpasupplicant is a WPA Supplicant for Linux, BSD and Windows with support for WPA and WPA2 IEEE 802.11i / RSN. Supplicant is the IEEE 802.1X/WPA component that is used in the client stations. It implements key negotiation with a WPA Authenticator and it controls the roaming and IEEE 802.11...

Hcxdumptool - Small Tool To Capture Packets From Wlan Devices

Small tool to capture packets from wlan devices. After capturing, upload the "uncleaned" cap here https://wpa-sec.stanev.org/?submit to see if your ap or the client is vulnerable by using common wordlists. Convert the cap to hccapx and/or to WPA-PMKID-PBKDF2 hashline 16800 with hcxpcaptool hcxtoo...

Google Android Qualcomm component elevation of privilege vulnerability (CNVD-2018-18775)

Android is a free and open source Linux-based operating system led and developed by Google Inc. and the Open Handset Alliance. An elevation of privilege vulnerability exists in the Google Android Qualcomm component WLAN. An attacker can exploit the vulnerability to gain elevation of privilege...

The vulnerability of the `csr_update_fils_params_rso` function in the Qualcomm WLAN operating system for Android, found in the CAF file, allows a attacker to increase their privileges.

The vulnerability of the csrupdatefilsparamsrso function in the Qualcomm WLAN operating system’s Android component, found in the CAF file, is caused by a numerical overflow. Exploiting this vulnerability could allow a malicious actor to gain increased privileges remotely...

The vulnerability of the Qualcomm WLAN operating system driver for Android from the CAF repository allows a hacker to execute arbitrary code.

The vulnerability of the Qualcomm WLAN operating system driver for Android, found in the CAF repository, is caused by buffer overflow in the stack. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2018-5862

In wlanhddcfg80211vendorscan in all Android releases from CAF using the Linux kernel Android for MSM, Firefox OS for MSM, QRD Android before security patch level 2018-07-05, when SCANSSIDS and QCAWLANVENDORATTRSCANFREQUENCIES are parsed, a buffer overwrite can potentially occur...

CVE-2018-5862

In wlanhddcfg80211vendorscan in all Android releases from CAF using the Linux kernel Android for MSM, Firefox OS for MSM, QRD Android before security patch level 2018-07-05, when SCANSSIDS and QCAWLANVENDORATTRSCANFREQUENCIES are parsed, a buffer overwrite can potentially occur...