← Back

Android

android

Vendor: Google • 8,153 CVEs

CVEs (8,153)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
1Google
1Android
Nov 21, 2024
Jul 6, 2018
N/A· v4
7.0 HIGH· v3
4.4 MEDIUM· v2
Due to a race condition while processing the power stats debug file to read status, a double free condition can occur in Android releases from CAF using the linux kernel (Android for MSM, Firefox OS for MSM, QRD Android)...Show more
Due to a race condition while processing the power stats debug file to read status, a double free condition can occur in Android releases from CAF using the linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before security patch level 2018-06-05.Show less
1Google
1Android
Nov 21, 2024
Jul 6, 2018
N/A· v4
5.5 MEDIUM· v3
2.1 LOW· v2
In Android releases from CAF using the linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before security patch level 2018-06-05, the function UpdateDeviceStatus() writes a local stack buffer without initial...Show more
In Android releases from CAF using the linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before security patch level 2018-06-05, the function UpdateDeviceStatus() writes a local stack buffer without initialization to flash memory using WriteToPartition() which may potentially leak memory.Show less
1Google
1Android
Nov 21, 2024
Jul 6, 2018
N/A· v4
5.5 MEDIUM· v3
2.1 LOW· v2
While flashing meta image, a buffer over-read may potentially occur when the image size is smaller than the image header size or is smaller than the image header size + total image header entry in Android releases from C...Show more
While flashing meta image, a buffer over-read may potentially occur when the image size is smaller than the image header size or is smaller than the image header size + total image header entry in Android releases from CAF using the linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before security patch level 2018-06-05.Show less
1Google
1Android
Nov 21, 2024
Jul 6, 2018
N/A· v4
5.5 MEDIUM· v3
2.1 LOW· v2
While flashing a meta image, a buffer over-read can potentially occur when the number of images are out of the maximum range of 32 in Android releases from CAF using the linux kernel (Android for MSM, Firefox OS for MSM,...Show more
While flashing a meta image, a buffer over-read can potentially occur when the number of images are out of the maximum range of 32 in Android releases from CAF using the linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before security patch level 2018-06-05.Show less
1Google
1Android
Jun 17, 2026
Jun 15, 2018
N/A· v4
7.8 HIGH· v3
4.6 MEDIUM· v2
If userspace provides a too-large WPA RSN IE length in wlan_hdd_cfg80211_set_ie(), a buffer overflow occurs in all Android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the Linux kernel.
1Google
1Android
Jun 17, 2026
Jun 15, 2018
N/A· v4
5.5 MEDIUM· v3
4.9 MEDIUM· v2
In the MDSS driver in all Android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the Linux kernel, a data structure may be used without being initialized correctly.
1Google
1Android
Nov 21, 2024
Jun 15, 2018
N/A· v4
5.5 MEDIUM· v3
4.9 MEDIUM· v2
User process can perform the kernel DOS in ashmem when doing cache maintenance operation in all Android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the Linux kernel.
1Google
1Android
Jun 17, 2026
Jun 15, 2018
N/A· v4
7.8 HIGH· v3
4.6 MEDIUM· v2
In the WCD CPE codec, a Use After Free condition can occur in all Android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the Linux kernel.
1Google
1Android
Jun 17, 2026
Jun 15, 2018
N/A· v4
7.8 HIGH· v3
4.6 MEDIUM· v2
A stack-based buffer overflow can occur in fastboot from all Android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the Linux kernel.
1Google
1Android
Jun 17, 2026
Jun 12, 2018
N/A· v4
7.8 HIGH· v3
4.6 MEDIUM· v2
Buffer over flow can occur while processing a HTT_T2H_MSG_TYPE_TX_COMPL_IND message with an out-of-range num_msdus value in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux...Show more
Buffer over flow can occur while processing a HTT_T2H_MSG_TYPE_TX_COMPL_IND message with an out-of-range num_msdus value in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.Show less
1Google
1Android
Jun 17, 2026
Jun 12, 2018
N/A· v4
7.0 HIGH· v3
4.4 MEDIUM· v2
Due to a race condition in the QTEECOM driver in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel, when more than one HLOS client loads the same TA, a Use After Free...Show more
Due to a race condition in the QTEECOM driver in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel, when more than one HLOS client loads the same TA, a Use After Free condition can occur.Show less
3Debian
GoogleRedhat
6Android
Debian LinuxEnterprise Linux Desktop+3 more
Jun 17, 2026
Jun 12, 2018
N/A· v4
7.8 HIGH· v3
4.6 MEDIUM· v2
In the function wmi_set_ie(), the length validation code does not handle unsigned integer overflow properly. As a result, a large value of the 'ie_len' argument can cause a buffer overflow in all Android releases from CA...Show more
In the function wmi_set_ie(), the length validation code does not handle unsigned integer overflow properly. As a result, a large value of the 'ie_len' argument can cause a buffer overflow in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.Show less
1Google
1Android
Jun 17, 2026
Jun 12, 2018
N/A· v4
7.8 HIGH· v3
4.6 MEDIUM· v2
Early or late retirement of rotation requests can result in a Use After Free condition in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.
1Google
1Android
Jun 17, 2026
Jun 12, 2018
N/A· v4
7.8 HIGH· v3
4.6 MEDIUM· v2
In the video driver function set_output_buffers(), binfo can be accessed after being freed in a failure scenario in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.
1Google
1Android
Jun 17, 2026
Jun 12, 2018
N/A· v4
7.8 HIGH· v3
4.6 MEDIUM· v2
In the function wma_pdev_div_info_evt_handler() in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel, there is no upper bound check on the value event->num_chains_val...Show more
In the function wma_pdev_div_info_evt_handler() in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel, there is no upper bound check on the value event->num_chains_valid received from firmware which can lead to a buffer overwrite of the fixed size chain_rssi_result structure.Show less
1Google
1Android
Jun 17, 2026
Jun 12, 2018
N/A· v4
7.8 HIGH· v3
4.6 MEDIUM· v2
An arbitrary address write can occur if a compromised WLAN firmware sends incorrect data to WLAN driver in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.
1Google
1Android
Nov 21, 2024
Jun 12, 2018
N/A· v4
7.8 HIGH· v3
4.6 MEDIUM· v2
Buffer overflow can occur due to improper input validation in multiple WMA event handler functions in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.
1Google
1Android
Nov 21, 2024
Jun 12, 2018
N/A· v4
7.8 HIGH· v3
4.6 MEDIUM· v2
In the WLAN driver in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel, a buffer overwrite can occur if the vdev_id received from firmware is larger than max_bssid.
1Google
1Android
Nov 21, 2024
Jun 12, 2018
N/A· v4
5.5 MEDIUM· v3
2.1 LOW· v2
In the WLAN driver in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel, event->num_entries_in_page is a value received from firmware that is not properly validated w...Show more
In the WLAN driver in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel, event->num_entries_in_page is a value received from firmware that is not properly validated which can lead to a buffer over-readShow less
1Google
1Android
Nov 21, 2024
Jun 12, 2018
N/A· v4
7.8 HIGH· v3
4.6 MEDIUM· v2
improper validation of array index in WiFi driver function sapInterferenceRssiCount() leads to array out-of-bounds access in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linu...Show more
improper validation of array index in WiFi driver function sapInterferenceRssiCount() leads to array out-of-bounds access in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.Show less