vciy

Qualcomm, Inc. Android for MSM, Firefox OS for MSM, QRD…: 27 records in one advisory

27 records announced together, published 2017-12-05, every one of them citing the same advisory.

The advisory

Every record in this batch cites https://source.android.com/security/bulletin/pixel/2017-12-01. That is the CNA's own reference, held in the index, and it is why these records are on one page.

What the records offer

No record in this batch publishes a fixed version in held sources.

No record in this batch is listed by CISA in held sources.

22 of 27 records name something of its own. For the other 5, held sources say the same thing about each.

Most commonly mapped weakness across the batch: Buffer Copy without Checking Size of Input in…

What this page does not cover

This batch is 27 of the 48 records that cite the same advisory. The other 21 are different findings announced alongside it.

None of those 21 is grouped with any other. Each one has its own record page and nothing else.

The batch is what one advisory announced. It is not every record sharing this weakness, this product or this mechanism, and nothing here is scoped to any estate.

Listed for shared announcement, not shared vulnerability. Each record here is its own finding with its own page, and fixing one does not address another.

CVE-2017-11016fails creating calibration blockUse After Free in Audio
CVE-2017-11019fd allocated during get_metadataUse After Free in Display
CVE-2017-11030hdmi hdmi_edid_sysfs_rda_res_info perform writeUse of Out-of-range Pointer Offset in Display
CVE-2017-11031vidioc_g_sde_rotator_fence usedUse After Free in Display
CVE-2017-11033coresight-tmc simultaneous enable etrUse After Free in Kernel
CVE-2017-11042imsservice iqtiimsext aidl apisPermissions
CVE-2017-11044kgslUse After Free in Graphics
CVE-2017-11045no title heldUse After Free in Camera
CVE-2017-11047graphics handler lack copy_from_userImproper Input Validation in Display
CVE-2017-11049no title heldImproper Input Validation in Display
CVE-2017-14896there field validation mobicoreInteger overflow leading to kernel memory write…
CVE-2017-14898no title heldBuffer overrun vulnerability in txpower scale…
CVE-2017-14899qca_nl80211_vendor_subcmd_set_txpower_scale_decr_db qca_wlan_vendor_attr_txpower_scale_decr_dbBuffer overrun vulnerability in txpower scale…
CVE-2017-14900qca_nl80211_vendor_subcmd_get_chain_rssi qca_wlan_vendor_attr_mac_addr bytesBuffer overrun vulnerability in get chain RSSI…
CVE-2017-14901no title heldBuffer overrun vulnerability in txpower scale…
CVE-2017-14903sendactionframe payload lessPotential buffer over-read when processing…
CVE-2017-14905specially cfg80211Potential buffer over-read in WLAN driver when…
CVE-2017-14907cryptographic strength reduced derivingCryptographic Issues in TrustZone
CVE-2017-15813reading firmware logsBuffer Copy without Checking Size of Input in…
CVE-2017-9698improperly specified offset/size valuesInteger Overflow to Buffer Overflow in Graphics
CVE-2017-9700fw_name_store image name charactersUse of Out-of-range Pointer Offset in Audio
CVE-2017-9703no title heldUse After Free in Camera
CVE-2017-9708msm_ois_power_down reg_ptr sub msm_camera_config_single_vregUse After Free in Camera
CVE-2017-9709escalation telephonyImproper Access Control in Telephony
CVE-2017-9710interface send qmi notifyBuffer Copy without Checking Size of Input in…
CVE-2017-9718multimediaTime-of-check Time-of-use (TOCTOU) Race…
CVE-2017-9722updating custom edid hdmi_tx_sysfs_wta_edidBuffer Copy without Checking Size of Input in…

27 records, read from the index as it stood on 2026-10-18. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.