vciy

In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF: 23 records in one advisory

23 records announced together, published 2018-11-27, every one of them citing the same advisory.

The advisory

Every record in this batch cites https://www.codeaurora.org/security-bulletin/2018/11/05/november-2018-code-aurora-forum-security…. That is the CNA's own reference, held in the index, and it is why these records are on one page.

What the records offer

No record in this batch publishes a fixed version in held sources.

No record in this batch is listed by CISA in held sources.

22 of 23 records name something of its own. For the other 1, held sources say the same thing about each.

What this page does not cover

Every record citing this advisory is on this page.

The batch is what one advisory announced. It is not every record sharing this weakness, this product or this mechanism, and nothing here is scoped to any estate.

Listed for shared announcement, not shared vulnerability. Each record here is its own finding with its own page, and fixing one does not address another.

CVE-2017-11078header bounds read
CVE-2018-11823freeing failure result double
CVE-2018-11906concern default privileged adb
CVE-2018-11908no title held
CVE-2018-11918allocated automatically released by
CVE-2018-11919handling soc infrastructure
CVE-2018-11943fastboot flash command leak
CVE-2018-11946upnp daemon should running
CVE-2018-11956mounting dsp
CVE-2018-11995name-check variable reset every
CVE-2018-5856race condition condition audio
CVE-2018-5861existing checks place on
CVE-2018-5904list traversal lpm status
CVE-2018-5908possible length validation
CVE-2018-5909checking into
CVE-2018-5910check callers count parameter

23 records, read from the index as it stood on 2026-10-18. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.