vciy

Qualcomm, Inc. Android for MSM, Firefox OS for MSM, QRD…: 23 records in one advisory

23 records announced together, published between 2018-04-03 and 2018-05-17, every one of them citing the same advisory.

The advisory

Every record in this batch cites https://source.android.com/security/bulletin/pixel/2018-04-01. That is the CNA's own reference, held in the index, and it is why these records are on one page.

What the records offer

No record in this batch publishes a fixed version in held sources.

No record in this batch is listed by CISA in held sources.

21 of 23 records name something of its own. For the other 2, held sources say the same thing about each.

Most commonly mapped weakness across the batch: Buffer Copy without Checking Size of Input in…

What this page does not cover

This batch is 23 of the 41 records that cite the same advisory. The other 18 are different findings announced alongside it.

None of those 18 is grouped with any other. Each one has its own record page and nothing else.

The batch is what one advisory announced. It is not every record sharing this weakness, this product or this mechanism, and nothing here is scoped to any estate.

Listed for shared announcement, not shared vulnerability. Each record here is its own finding with its own page, and fixing one does not address another.

CVE-2017-11075cmd_pkt reg_pkt are calledUse After Free in Audio
CVE-2017-14880wan-driver multiple requests modem/user-spaceTime-of-check Time-of-use (TOCTOU) Race…
CVE-2017-14890swba vdev_map wma_send_bcn_buf_llImproper Validation of Array Index in WLAN
CVE-2017-14894wma_vdev_start_resp_handler vdev part wmi_vdev_start_resp_eventidImproper Validation of Array Index in WLAN
CVE-2017-15836sends ready host largeInteger Overflow to Buffer Overflow in WLAN
CVE-2017-15837policy pattern attribute nl80211_pktpat_offsetBuffer Over-read in WLAN
CVE-2017-15853ptt commands ptt_sock_send_msg_to_app invokedBuffer Over-read in WLAN
CVE-2017-15855triggers user-memory-access issue cppBuffer Copy without Checking Size of Input in…
CVE-2018-3567htt_t2h_msg_type_peer_map htt_t2h_msg_type_peer_unmapBuffer Copy without Checking Size of Input in…
CVE-2018-3568wlan_hdd_cfg80211_vendor_scanBuffer Copy without Checking Size of Input…
CVE-2018-3584rmnet_usb_ctrl_initUse After Free in Wiredconnectivity
CVE-2018-3596legacy vulnerable migration beenPotential issues related to migration from 32…
CVE-2018-3598insufficient parameters leak out-of-boundsInformation Exposure in Camera
CVE-2018-3599notifying dci clientUse After Free in Core
CVE-2018-5820wma_tbttoffset_update_event_handler parameter allocate memoryInteger Overflow to Buffer Overflow in WLAN
CVE-2018-5821wma_wow_wakeup_host_event wake_info->vdev_id array indexImproper Restriction of Operations within the…
CVE-2018-5822compromisedBuffer overflow vulnerability in WLAN
CVE-2018-5823improperBuffer Copy without Checking Size of Input in…
CVE-2018-5824htt_t2h_msg_type_rx_flush htt_t2h_msg_type_rx_pn_ind tid obtainedBuffer Copy without Checking Size of Input in…
CVE-2018-5825no title heldUse After Free in Data
CVE-2018-5826dueUse After Free in WLAN
CVE-2018-5827no title heldBuffer Copy without Checking Size of Input in…
CVE-2018-5828wma_extscan_start_stop_event_handler vdev_id comesImproper Restriction of Operations within the…

23 records, read from the index as it stood on 2026-10-18. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.