# |
CVE ID
|
CWE ID
|
# of Exploits
|
Vulnerability Type(s)
|
Publish Date
|
Update Date
|
Score
|
Gained Access Level
|
Access
|
Complexity
|
Authentication
|
Conf.
|
Integ.
|
Avail.
|
1 |
CVE-2018-3561 |
416 |
|
|
2018-03-16 |
2018-04-04 |
4.4 |
None |
Local |
Medium |
Not required |
Partial |
Partial |
Partial |
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a race condition in diag_ioctl_lsm_deinit() leads to a Use After Free condition. |
2 |
CVE-2018-3560 |
415 |
|
|
2018-03-16 |
2018-04-04 |
4.6 |
None |
Local |
Low |
Not required |
Partial |
Partial |
Partial |
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a Double Free vulnerability exists in Audio Driver while opening a sound compression device. |
3 |
CVE-2017-18069 |
119 |
|
Overflow |
2018-03-15 |
2018-04-06 |
7.8 |
None |
Remote |
Low |
Not required |
Complete |
None |
None |
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper message length calculation in oem_cmd_handler() while processing a WLAN_NL_MSG_OEM netlink message leads to buffer overread. |
4 |
CVE-2017-18068 |
119 |
|
Overflow |
2018-03-15 |
2018-04-06 |
7.2 |
None |
Local |
Low |
Not required |
Complete |
Complete |
Complete |
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper buffer length calculation in wma_roam_scan_filter() leads to buffer overflow. |
5 |
CVE-2017-18067 |
20 |
|
Overflow |
2018-03-15 |
2018-04-06 |
10.0 |
None |
Remote |
Low |
Not required |
Complete |
Complete |
Complete |
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation while processing an encrypted authentication management frame in lim_send_auth_mgmt_frame() leads to buffer overflow. |
6 |
CVE-2017-18066 |
416 |
|
|
2018-03-16 |
2018-04-04 |
4.6 |
None |
Local |
Low |
Not required |
Partial |
Partial |
Partial |
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper controls in MSM CORE leads to use memory after it is freed in msm_core_ioctl(). |
7 |
CVE-2017-18065 |
20 |
|
Exec Code |
2018-03-16 |
2018-04-04 |
4.6 |
None |
Local |
Low |
Not required |
Partial |
Partial |
Partial |
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for vent->vdev_id in wma_action_frame_filter_mac_event_handler(), which is received from firmware, leads to arbitrary code execution. |
8 |
CVE-2017-18064 |
20 |
|
Overflow |
2018-03-15 |
2018-04-06 |
7.2 |
None |
Local |
Low |
Not required |
Complete |
Complete |
Complete |
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for p2p_noa_info in wma_send_bcn_buf_ll() which is received from firmware leads to potential buffer overflow. |
9 |
CVE-2017-18063 |
20 |
|
|
2018-03-15 |
2018-04-06 |
7.2 |
None |
Local |
Low |
Not required |
Complete |
Complete |
Complete |
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for nlo_event in wma_nlo_match_evt_handler(), which is received from firmware, leads to potential out of bound memory access. |
10 |
CVE-2017-18062 |
119 |
|
Overflow |
2018-03-16 |
2018-04-04 |
4.6 |
None |
Local |
Low |
Not required |
Partial |
Partial |
Partial |
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, potential buffer overflow can happen when processing UTF event in wma_process_utf_event(). |
11 |
CVE-2017-18061 |
119 |
|
Overflow |
2018-03-16 |
2018-04-04 |
4.6 |
None |
Local |
Low |
Not required |
Partial |
Partial |
Partial |
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, potential buffer overflow can happen when processing AOA measurement event from WIGIG firmware in wil_aoa_evt_meas(). |
12 |
CVE-2017-18060 |
125 |
|
|
2018-03-16 |
2018-04-04 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for resp_event->vdev_id in wma_unified_bcntx_status_event_handler(), which is received from firmware, leads to potential out of bounds memory read. |
13 |
CVE-2017-18059 |
125 |
|
|
2018-03-16 |
2018-04-04 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for vdev id in wma_scan_event_callback(), which is received from firmware, leads to potential out of bounds memory read. |
14 |
CVE-2017-18058 |
125 |
|
|
2018-03-16 |
2018-04-04 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for wow_buf_pkt_len in wma_wow_wakeup_host_event() which is received from firmware leads to potential out of bounds memory read. |
15 |
CVE-2017-18057 |
125 |
|
|
2018-03-16 |
2018-04-04 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for vdev id in wma_nlo_scan_cmp_evt_handler(), which is received from firmware, leads to potential out of bounds memory read. |
16 |
CVE-2017-18056 |
125 |
|
|
2018-03-15 |
2018-04-06 |
7.2 |
None |
Local |
Low |
Not required |
Complete |
Complete |
Complete |
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for vdev_id in wma_unified_bcntx_status_event_handler() which is received from firmware leads to potential out of bounds memory read. |
17 |
CVE-2017-18055 |
20 |
|
Overflow |
2018-03-16 |
2018-04-04 |
4.6 |
None |
Local |
Low |
Not required |
Partial |
Partial |
Partial |
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for wmi_event->num_vdev_mac_entries in wma_pdev_set_hw_mode_resp_evt_handler(), which is received from firmware, leads to potential buffer overflow. |
18 |
CVE-2017-18054 |
20 |
|
Overflow |
2018-03-16 |
2018-04-04 |
4.6 |
None |
Local |
Low |
Not required |
Partial |
Partial |
Partial |
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for num_vdev_mac_entries in wma_pdev_hw_mode_transition_evt_handler(), which is received from firmware, leads to potential buffer overflow. |
19 |
CVE-2017-18053 |
125 |
|
|
2018-03-16 |
2018-04-04 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for fix_param->vdev_id in wma_p2p_lo_event_handler(), which is received from firmware, leads to potential out of bounds memory read. |
20 |
CVE-2017-18052 |
125 |
|
|
2018-03-16 |
2018-04-04 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for cmpl_params->num_reports, param_buf->desc_ids and param_buf->status in wma_mgmt_tx_bundle_completion_handler(), which is received from firmware, leads to potential out of bounds memory read. |
21 |
CVE-2017-18051 |
125 |
|
|
2018-03-16 |
2018-04-04 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for event->vdev_id in wma_rcpi_event_handler(), which is received from firmware, leads to potential out of bounds memory read. |
22 |
CVE-2017-18050 |
125 |
|
|
2018-03-16 |
2018-04-04 |
4.6 |
None |
Local |
Low |
Not required |
Partial |
Partial |
Partial |
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for vdev_map in wma_tbttoffset_update_event_handler(), which is received from firmware, leads to potential buffer overwrite and out of bounds memory read. |
23 |
CVE-2017-17860 |
20 |
|
|
2018-01-18 |
2018-02-06 |
5.7 |
None |
Local Network |
Medium |
Not required |
None |
None |
Complete |
In Samsung Gear products, Bluetooth link key is updated to the different key which is same with attacker's link key. It can be attacked without user's intention only if attacker can reveal the Bluetooth address of target device and paired user's smartphone |
24 |
CVE-2017-17767 |
119 |
|
Overflow |
2018-02-23 |
2018-03-12 |
7.2 |
None |
Local |
Low |
Not required |
Complete |
Complete |
Complete |
In all Qualcomm products with Android releases from CAF using the Linux kernel, the IL client may free a buffer OMX Video Encoder Component and then subsequently access the already freed buffer. |
25 |
CVE-2017-17765 |
119 |
|
Overflow |
2018-02-23 |
2018-03-12 |
7.2 |
None |
Local |
Low |
Not required |
Complete |
Complete |
Complete |
In all Qualcomm products with Android releases from CAF using the Linux kernel, multiple values received from firmware are not properly validated in wma_get_ll_stats_ext_buf() and are used to allocate the sizes of buffers and may be vulnerable to integer overflow leading to buffer overflow. |
26 |
CVE-2017-17764 |
190 |
|
Overflow |
2018-02-23 |
2018-03-12 |
7.2 |
None |
Local |
Low |
Not required |
Complete |
Complete |
Complete |
In all Qualcomm products with Android releases from CAF using the Linux kernel, the num_failure_info value from firmware is not properly validated in wma_rx_aggr_failure_event_handler() so that an integer overflow vulnerability in a buffer size calculation may potentially lead to a buffer overflow. |
27 |
CVE-2017-15862 |
190 |
|
Overflow |
2018-02-23 |
2018-03-12 |
7.2 |
None |
Local |
Low |
Not required |
Complete |
Complete |
Complete |
In all Qualcomm products with Android releases from CAF using the Linux kernel, in wma_unified_link_radio_stats_event_handler(), the number of radio channels coming from firmware is not properly validated, potentially leading to an integer overflow vulnerability followed by a buffer overflow. |
28 |
CVE-2017-15861 |
129 |
|
|
2018-02-23 |
2018-03-12 |
7.2 |
None |
Local |
Low |
Not required |
Complete |
Complete |
Complete |
In all Qualcomm products with Android releases from CAF using the Linux kernel, in the function wma_roam_synch_event_handler, vdev_id is received from firmware and used to access an array without validation. |
29 |
CVE-2017-15860 |
119 |
|
Overflow |
2018-02-23 |
2018-03-12 |
9.3 |
None |
Remote |
Medium |
Not required |
Complete |
Complete |
Complete |
In all Qualcomm products with Android releases from CAF using the Linux kernel, while processing an encrypted authentication management frame, a stack buffer overflow may potentially occur. |
30 |
CVE-2017-15850 |
200 |
|
+Info |
2018-01-10 |
2018-01-26 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, userspace can read values from audio codec registers. |
31 |
CVE-2017-15849 |
416 |
|
|
2018-01-10 |
2018-01-29 |
9.3 |
None |
Remote |
Medium |
Not required |
Complete |
Complete |
Complete |
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a LayerStack can be destroyed in between Validate and Commit by the application resulting in a Use After Free condition. |
32 |
CVE-2017-15848 |
119 |
|
Overflow |
2018-01-10 |
2018-01-26 |
4.6 |
None |
Local |
Low |
Not required |
Partial |
Partial |
Partial |
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the fastrpc kernel driver, a buffer overflow vulnerability from userspace may potentially exist. |
33 |
CVE-2017-15847 |
362 |
|
|
2018-01-10 |
2018-01-26 |
4.4 |
None |
Local |
Medium |
Not required |
Partial |
Partial |
Partial |
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the SPCom kernel driver, a race condition exists when creating a channel. |
34 |
CVE-2017-15845 |
119 |
|
Overflow |
2018-01-10 |
2018-01-26 |
4.6 |
None |
Local |
Low |
Not required |
Partial |
Partial |
Partial |
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, an invalid input of firmware size (negative value) from user space can potentially lead to the memory leak or buffer overflow during the WLAN cal data store operation. |
35 |
CVE-2017-15834 |
119 |
|
Overflow |
2018-03-16 |
2018-04-04 |
4.4 |
None |
Local |
Medium |
Not required |
Partial |
Partial |
Partial |
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, race condition in diag_dbgfs_read_dcistats(), while accessing diag_dbgfs_dci_data_index, causes potential heap overflow. |
36 |
CVE-2017-15833 |
200 |
|
+Info |
2018-03-16 |
2018-04-04 |
4.6 |
None |
Local |
Low |
Not required |
Partial |
Partial |
Partial |
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, untrusted pointer dereference in update_userspace_power() function in power leads to information exposure. |
37 |
CVE-2017-15831 |
20 |
|
Overflow |
2018-03-16 |
2018-04-04 |
4.6 |
None |
Local |
Low |
Not required |
Partial |
Partial |
Partial |
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the function wma_ndp_end_indication_event_handler(), there is no input validation check on a event_info value coming from firmware, which can cause an integer overflow and then leads to potential heap overwrite. |
38 |
CVE-2017-15830 |
129 |
|
Overflow |
2018-03-16 |
2018-04-05 |
4.6 |
None |
Local |
Low |
Not required |
Partial |
Partial |
Partial |
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper ch_list array index initialization in function sme_set_plm_request() causes potential buffer overflow. |
39 |
CVE-2017-15829 |
362 |
|
|
2018-02-23 |
2018-03-12 |
6.9 |
None |
Local |
Medium |
Not required |
Complete |
Complete |
Complete |
In all Qualcomm products with Android releases from CAF using the Linux kernel, a race condition exists in a GPU Driver which can potentially lead to a Use After Free condition. |
40 |
CVE-2017-15821 |
119 |
|
Overflow |
2018-03-15 |
2018-04-06 |
7.2 |
None |
Local |
Low |
Not required |
Complete |
Complete |
Complete |
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the function wma_p2p_noa_event_handler(), there is no bound check on a value coming from firmware which can potentially lead to a buffer overwrite. |
41 |
CVE-2017-15820 |
416 |
|
|
2018-02-23 |
2018-03-12 |
7.2 |
None |
Local |
Low |
Not required |
Complete |
Complete |
Complete |
In all Qualcomm products with Android releases from CAF using the Linux kernel, in a KGSL IOCTL handler, a Use After Free Condition can potentially occur. |
42 |
CVE-2017-15817 |
20 |
|
|
2018-02-23 |
2018-03-12 |
9.3 |
None |
Remote |
Medium |
Not required |
Complete |
Complete |
Complete |
In all Qualcomm products with Android releases from CAF using the Linux kernel, when an access point sends a challenge text greater than 128 bytes, the host driver is unable to validate this potentially leading to authentication failure. |
43 |
CVE-2017-15815 |
119 |
|
Overflow |
2018-03-15 |
2018-04-06 |
10.0 |
None |
Remote |
Low |
Not required |
Complete |
Complete |
Complete |
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a potential buffer overflow can happen when processing any 802.11 MGMT frames like Auth frame in limProcessAuthFrame. |
44 |
CVE-2017-15814 |
125 |
|
|
2018-03-16 |
2018-04-05 |
2.1 |
None |
Local |
Low |
Not required |
Partial |
None |
None |
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in msm_flash_subdev_do_ioctl of drivers/media/platform/msm/camera_v2/sensor/flash/msm_flash.c, there is a possible out of bounds read if flash_data.cfg_type is CFG_FLASH_INIT due to improper input validation. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. |
45 |
CVE-2017-15813 |
119 |
|
Overflow |
2017-12-05 |
2017-12-15 |
7.5 |
None |
Remote |
Low |
Not required |
Partial |
Partial |
Partial |
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a buffer overflow can occur while reading firmware logs. |
46 |
CVE-2017-14918 |
416 |
|
|
2017-12-05 |
2017-12-20 |
10.0 |
None |
Remote |
Low |
Not required |
Complete |
Complete |
Complete |
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the GPS location wireless interface, a Use After Free condition can occur. |
47 |
CVE-2017-14917 |
119 |
|
Overflow |
2017-12-05 |
2017-12-20 |
10.0 |
None |
Remote |
Low |
Not required |
Complete |
Complete |
Complete |
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, buffer sizes in the message passing interface are not properly validated. |
48 |
CVE-2017-14916 |
119 |
|
Overflow |
2017-12-05 |
2017-12-20 |
10.0 |
None |
Remote |
Low |
Not required |
Complete |
Complete |
Complete |
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, buffer sizes in the message passing interface are not properly validated. |
49 |
CVE-2017-14914 |
20 |
|
|
2017-12-05 |
2017-12-20 |
10.0 |
None |
Remote |
Low |
Not required |
Complete |
Complete |
Complete |
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, handles in the global client structure can become stale. |
50 |
CVE-2017-14909 |
20 |
|
|
2017-12-05 |
2017-12-19 |
10.0 |
None |
Remote |
Low |
Not required |
Complete |
Complete |
Complete |
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a count value that is read from a file is not properly validated. |