goodix_tool.c in the Goodix gt915 touchscreen driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, relies on user-space length values for kernel-memory copies of procfs file content, which allows attackers to gain privileges or cause a denial of service (memory corruption) via an application that provides crafted values.

The MSM camera driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to obtain sensitive information from kernel stack memory via (1) a crafted MSM_MCR_IOCTL_EVT_GET ioctl call, related to drivers/media/platform/msm/camera_v1/mercury/msm_mercury_sync.c, or (2) a crafted MSM_JPEG_IOCTL_EVT_GET ioctl call, related to drivers/media/platform/msm/camera_v2/jpeg_10/msm_jpeg_sync.c.

The CONFIG_STRICT_MEMORY_RWX implementation for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not properly consider certain memory sections, which makes it easier for attackers to bypass intended access restrictions by leveraging the presence of RWX memory at a fixed location.

Multiple stack-based buffer overflows in the MSM camera driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allow attackers to gain privileges via (1) a crafted VIDIOC_MSM_VPE_DEQUEUE_STREAM_BUFF_INFO ioctl call, related to drivers/media/platform/msm/camera_v2/pproc/vpe/msm_vpe.c, or (2) a crafted VIDIOC_MSM_CPP_DEQUEUE_STREAM_BUFF_INFO ioctl call, related to drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c.

Unspecified vulnerability in the YagattaTalk Messenger (com.iskoot.yagatta.yagattatalk) application 1.00.01.08 for Android has unknown impact and attack vectors.

Use-after-Free in MODEM

Denial of service in MODEM due to improper pointer handling

Information Exposure in DSP Services

Information exposure in DSP services due to improper handling of freeing memory

Incorrect Type Conversion in Video driver

Memory corruption in video driver due to type confusion error during video playback

Stack based buffer overflow in Core

Memory corruption due to stack-based buffer overflow in Core

Buffer copy without checking size of input in Modem

Memory corruption due to buffer copy without checking size of input in modem while receiving WMI_REQUEST_STATS_CMDID command.

Improper validation of array index in Android Core

Memory corruption in android core due to improper validation of array index while returning feature ids after license authentication.

Integer overflow to buffer overflow in Audio

Memory corruption in Audio due to integer overflow to buffer overflow while music playback of clips like amr,evrc,qcelp with modified content.

Buffer over-read in WLAN

Transient DOS due to buffer over-read in WLAN while parsing corrupted NAN frames.

Integer Overflow to Buffer Overflow in Automotive

Memory corruption in Automotive due to integer overflow to buffer overflow while registering a new listener with shared buffer.

Improper Input Validation in Automotive

Memory corruption in Automotive due to improper input validation.

Buffer Copy Without Checking Size of Input in Kernel

Memory corruption in kernel due to missing checks when updating the access rights of a memextent mapping.

Use-After-Free Issue in Display

Memory corruption in display due to double free while allocating frame buffer memory

Time-of-check Time-of-use Race Condition in Multimedia Framework

Memory corruption in Multimedia Framework due to unsafe access to the data members

Incorrect type casting in Display driver

Memory corruption in display driver due to incorrect type casting while accessing the fence structure fields

Integer Overflow to Buffer Overflow in Bluetooth HOST

Memory corruption in Bluetooth HOST due to buffer overflow while parsing the command response received from remote