CVE Vulnerability Catalog

In Android for MSM, Firefox OS for MSM, and QRD Android, a race condition in a Camera driver can lead to a Use After Free condition.

In Android for MSM, Firefox OS for MSM, and QRD Android, a buffer overwrite is possible in fw_name_store if the image name is 64 characters long.

In Android for MSM, Firefox OS for MSM, and QRD Android, improperly specified offset/size values for a submission command may lead to a math operation overflow, resulting in access to arbitrary memory.

The malloc function in the GNU C Library (glibc or libc6) version 2.26 could return a memory block that is too small when attempting to allocate an object whose size is close to SIZE_MAX, potentially leading to a heap overflow.

In Android for MSM, while processing the QCA_NL80211_VENDOR_SUBCMD_SET_TXPOWER_SCALE vendor command, a buffer overrun occurs when the QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE attribute contains fewer than 1 byte.

In Android for MSM, while processing the QCA_NL80211_VENDOR_SUBCMD_GET_CHAIN_RSSI vendor command, a buffer overrun occurs when the QCA_WLAN_VENDOR_ATTR_MAC_ADDR attribute contains fewer than 6 bytes.

In Android for MSM, while processing the QCA_NL80211_VENDOR_SUBCMD_SET_TXPOWER_SCALE_DECR_DB vendor command, a buffer overrun occurs when the QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE_DECR_DB attribute contains fewer than 1 byte.

In Android for MSM, while processing the QCA_NL80211_VENDOR_SUBCMD_SET_TXPOWER_SCALE vendor command, a buffer overrun occurs when the QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE attribute contains fewer than 1 byte.

In Android for MSM, Firefox OS for MSM, and QRD Android, there is a memory allocation issue in the mobicore driver that does not validate the length field. This can lead to an undersized buffer allocation, ultimately resulting in a kernel memory overwrite.

In Android for MSM, Firefox OS for MSM, and QRD Android, a race condition exists in a video driver that can potentially lead to a buffer overflow.

In Android for MSM, Firefox OS for MSM, and QRD Android, in a graphics driver ioctl handler, the lack of copy_from_user() function calls may result in writes to kernel memory.

In Android for MSM, Firefox OS for MSM, and QRD Android, a race condition exists in a camera driver function that can lead to a Use After Free condition.

In Android for MSM, Firefox OS for MSM, and QRD Android, a race condition exists in a KGSL driver function that can lead to a Use After Free condition.

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, ImsService and the IQtiImsExt AIDL APIs are not subject to access control.

In Android for MSM, Firefox OS for MSM, and QRD Android, in the coresight-tmc driver, a simultaneous read and enable of the ETR device after changing the buffer size may result in a Use After Free condition of the previous buffer.

In Android for MSM, Firefox OS for MSM, and QRD Android, a vulnerability exists related to the VIDIOC_G_SDE_ROTATOR_FENCE ioctl command, which can lead to a Use After Free condition.

In Android for MSM, Firefox OS for MSM, and QRD Android, in the HDMI video driver function hdmi_edid_sysfs_rda_res_info(), userspace can perform an arbitrary write into kernel memory.

In Android for MSM, Firefox OS for MSM, and QRD Android, there is an issue with not closing the file descriptor (fd) during metadata retrieval, even though the buffer has been freed. This leads to a failure during the exit sequence.

In Android for MSM, Firefox OS for MSM, and QRD Android, there is an issue with improper memory management. When memory allocation fails while creating a calibration block, stale pointers are left uncleared.

It is possible to bypass the auto-unapprove plugin in Bitbucket via minimal brute-force because it relies on asynchronous events on the back-end. This allows an attacker to merge any code into unsuspecting repositories.