vciy

Qualcomm, Inc. Android for MSM, Firefox OS for MSM, QRD…: 25 records in one advisory

25 records announced together, published 2017-11-16, every one of them citing the same advisory.

The advisory

Every record in this batch cites https://source.android.com/security/bulletin/pixel/2017-11-01. That is the CNA's own reference, held in the index, and it is why these records are on one page.

What the records offer

No record in this batch publishes a fixed version in held sources.

No record in this batch is listed by CISA in held sources.

24 of 25 records name something of its own. For the other 1, held sources say the same thing about each.

Most commonly mapped weakness across the batch: Buffer Copy without Checking Size of Input in…

What this page does not cover

This batch is 25 of the 48 records that cite the same advisory. The other 23 are different findings announced alongside it.

None of those 23 is grouped with any other. Each one has its own record page and nothing else.

The batch is what one advisory announced. It is not every record sharing this weakness, this product or this mechanism, and nothing here is scoped to any estate.

Listed for shared announcement, not shared vulnerability. Each record here is its own finding with its own page, and fixing one does not address another.

CVE-2017-11012qca_nl80211_vendor_subcmd_encryption_test stack-basedStack-based Buffer Overflow in WLAN
CVE-2017-11018array boundsBuffer Copy without Checking Size of Input in…
CVE-2017-11022probe requests originated user'sInformation Exposure in WLAN
CVE-2017-11023there possibility out-of-bound noBuffer Copy without Checking Size of Input in…
CVE-2017-11024rmnet usb afterUse After Free in Core
CVE-2017-11025audio_effects_shared_ioctl corruptionTime-of-check Time-of-use (TOCTOU) Race…
CVE-2017-11026frp partition reference frpImproper Authorization in Boot
CVE-2017-11027ubi validated smaller minimumInformation Exposure in Boot
CVE-2017-11029triggers user-memory-access issue asBuffer Copy without Checking Size of Input in…
CVE-2017-11032double kmalloc fails allocateDouble Free in Kernel
CVE-2017-11035functions sme_set_ft_ies csr_roam_issue_ft_preauth_req incorrectBuffer Copy without Checking Size of Input in…
CVE-2017-11038bypassed supplying different atTime-of-check Time-of-use (TOCTOU) Race…
CVE-2017-11058no title heldBuffer Over-read in WLAN
CVE-2017-11073qcacld pktlog mapping proc/ath_pktlog/cldImproper Input Validation in WLAN
CVE-2017-11085integer leading improper boundInteger Overflow to Buffer Overflow in Audio
CVE-2017-11089nl80211_set_station attribute nl80211_attr_local_mesh_power_modeBuffer Over-read in WLAN
CVE-2017-11090wlan_hdd_cfg80211_set_pmksa pmkid wlan_pmkid_lenBuffer Over-read in WLAN
CVE-2017-11091mdss_rotator_ioctl dev/mdss_rotator use-after-free fenceUse After Free in Display
CVE-2017-11093display upper-bound validation readingBuffer Over-read in Display
CVE-2017-8279missing protection updating msgTime-of-check Time-of-use (TOCTOU) Race…
CVE-2017-9696msm_isp_stop_stats_stream variable stream_cfg_cmd->num_streams itBuffer Over-read in Camera
CVE-2017-9701oem unlock/unlock-go fastboot commandsUse of Uninitialized Variable in Boot
CVE-2017-9702user-space pointer accessedUntrusted Pointer Dereference in Camera
CVE-2017-9719mdss hdmi cec frameBuffer Copy without Checking Size of Input in…
CVE-2017-9721loader splashBuffer Copy without Checking Size of Input in…

25 records, read from the index as it stood on 2026-10-18. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.