vciy

Qualcomm, Inc. Android for MSM, Firefox OS for MSM, QRD…: 54 records in one advisory

54 records announced together, published between 2018-09-18 and 2018-09-19, every one of them citing the same advisory.

The advisory

Every record in this batch cites https://www.codeaurora.org/security-bulletin/2018/09/04/september-2018-code-aurora-security-bull…. That is the CNA's own reference, held in the index, and it is why these records are on one page.

What the records offer

No record in this batch publishes a fixed version in held sources.

No record in this batch is listed by CISA in held sources.

48 of 54 records name something of its own. For the other 6, held sources say the same thing about each.

Most commonly mapped weakness across the batch: Buffer Copy Without Checking Size of Input in…

What this page does not cover

Every record citing this advisory is on this page.

The batch is what one advisory announced. It is not every record sharing this weakness, this product or this mechanism, and nothing here is scoped to any estate.

Listed for shared announcement, not shared vulnerability. Each record here is its own finding with its own page, and fixing one does not address another.

CVE-2017-15818loading application qseecom applicationInteger Overflow to Buffer Overflow in Core
CVE-2017-15825gptOut of bounds Access When Accessing Partition…
CVE-2017-15828keystore lk vulnerability existsInteger Overflow to Buffer Overflow…
CVE-2017-15844writing device values flashBuffer Over-read in Boot
CVE-2018-11265incrementing log_buf type uint64_tBuffer Copy Without Checking Size of Input in…
CVE-2018-11270devm_kzalloc released corruptionDouble Free in Wired Connectivity
CVE-2018-11273voice_svc_dev device-managed resource cdev_alloc_err
CVE-2018-11274payload extremelyBuffer Copy Without Checking Size of Input in…
CVE-2018-11275flashing fastbootlib divisible blockInformation Exposure in Boot
CVE-2018-11276explicitly failureDouble Free Issue in Kernel
CVE-2018-11278venus hw searches decodingBuffer Over-read in Video
CVE-2018-11280user-space no nat natImproper Input Validation in MODEM
CVE-2018-11281calling ipa_ioc_mdfy_rt_rule ipa headerUse After Free in Data
CVE-2018-11286global debug_client multi-thread manner
CVE-2018-11293wma_ndp_confirm_event_handler wma_ndp_indication_event_handler ndp_cfg lenBuffer Over-read in WLAN
CVE-2018-11294indication categories only firstAlways-Incorrect Control Flow Implementation in…
CVE-2018-11295carries fixed anqp exceedsInteger Overflow to Buffer Overflow in WLAN
CVE-2018-11296no title heldBuffer Copy without Checking Size of Input in…
CVE-2018-11297functions event_infoBuffer Over-read in WLAN
CVE-2018-11298set_passpoint_list hdd make surePossible Buffer Overflow in WLAN
CVE-2018-11299filled vdev id correctlyImproper Validation of Array Index in WLAN
CVE-2018-11300executed other thread also
CVE-2018-11301debug logInteger Underflow in WLAN
CVE-2018-11302no title heldBuffer Copy Without Checking Size of Input in…
CVE-2018-11818lut configuration down viaUse After Free in Display
CVE-2018-11826extInteger Overflow to Buffer Overflow in WLAN
CVE-2018-11827synchronizationImproper Validation of Array Index in WLAN
CVE-2018-11832pmic heapBuffer Copy Without Checking Size of Input in…
CVE-2018-11836out-of-boundsUncontrolled Resource Consumption in WLAN
CVE-2018-11840temporary reply twiceDouble Free in WLAN
CVE-2018-11842association allocates case memUse of Uninitialized Variable in WLAN
CVE-2018-11843foUse After Free in WLAN
CVE-2018-11851no title heldBuffer Copy Without Checking Size of Input in…
CVE-2018-11852api inputs fills sameBuffer Copy Without Checking Size of Input in…
CVE-2018-11860over flowBuffer Copy Without Checking Size of Input in…
CVE-2018-11863synchBuffer Copy Without Checking Size of Input in…
CVE-2018-11868nanBuffer Copy Without Checking Size of Input in…
CVE-2018-11869no title heldBuffer Copy Without Checking Size of Input in…
CVE-2018-11878possibilityReturn of Stack Variable Address in WLAN
CVE-2018-11883policy mgr unit testImproper Input Validation in WLAN
CVE-2018-11886mpduInteger Overflow to Buffer Overflow in WLAN
CVE-2018-11889requesting rssi context
CVE-2018-11891no title heldBuffer Over-read in WLAN
CVE-2018-11893argument ies
CVE-2018-11894preferred offload resultsInteger Overflow to Buffer Overflow in WLAN
CVE-2018-11895writes default rsn capabilitiesPotential Buffer Overflow in WLAN
CVE-2018-11897associating joined limitBuffer Copy Without Checking Size of Input in…
CVE-2018-11898bss upper layerBuffer Copy Without Checking Size of Input in…
CVE-2018-11902no title heldImproper Validation of Array Index in WLAN
CVE-2018-11903interfacesImproper Validation of Array Index in WLAN
CVE-2018-11904asynchronous callbacks callers shouldReturn of Stack Variable Address in WLAN
CVE-2018-3573relocating images specially craftedImproper Restriction of Operations within the…
CVE-2018-3574ion cache maintenance secureImproper Input Validation in Kernel
CVE-2018-5905num clients services boundary

54 records, read from the index as it stood on 2026-10-18. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.