CVE-2018-11919

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, there is a potential heap overflow and memory corruption due to improper error handling in SOC infrastructure.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://source.codeaurora.org/quic/la/kernel/msm-4.4/commit/?id=085e7272b4c5a41b1ab26c683591864aefab14fePatch, Third Party Advisory
https://source.codeaurora.org/quic/la/kernel/msm-4.9/commit/?id=87925782e640efb493f21bf0e255b6a638eea334Patch, Third Party Advisory
https://source.codeaurora.org/quic/qsdk/oss/kernel/linux-msm/commit/?id=456a408d62cef797107e3b0de7d05bb211742bbdPatch, Third Party Advisory
https://www.codeaurora.org/security-bulletin/2018/11/05/november-2018-code-aurora-forum-security-bulletinPatch, Third Party Advisory
https://source.codeaurora.org/quic/la/kernel/msm-4.4/commit/?id=085e7272b4c5a41b1ab26c683591864aefab14fePatch, Third Party Advisory
https://source.codeaurora.org/quic/la/kernel/msm-4.9/commit/?id=87925782e640efb493f21bf0e255b6a638eea334Patch, Third Party Advisory
https://source.codeaurora.org/quic/qsdk/oss/kernel/linux-msm/commit/?id=456a408d62cef797107e3b0de7d05bb211742bbdPatch, Third Party Advisory
https://www.codeaurora.org/security-bulletin/2018/11/05/november-2018-code-aurora-forum-security-bulletinPatch, Third Party Advisory

Timeline

Published: Nov 27, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-11928.8In Cloud Foundry Foundation cf-release versions prior to v285; cf-deployment versions prior to v1.7; UAA 4.5.x versions prior to 4.5.5, 4.8.CVE-2018-119217.8Failure condition is not handled properly and the correct error code is not returned. It could cause unintended SUI behavior and create unin CVE-2018-119225.5Wrong configuration in Touch Pal application can collect user behavior data without awareness by the user.CVE-2018-119237.8Improper buffer length check before copying can lead to integer overflow and then a buffer overflow in WMA event handler in Snapdragon Auto,CVE-2018-119247.8Improper buffer length validation in WLAN function can lead to a potential integer oveflow issue in Snapdragon Auto, Snapdragon Compute, Sna CVE-2018-119257.8Data length received from firmware is not validated against the max allowed size which can result in buffer overflow. in Snapdragon Auto, Sn CVE-2018-119277.8Improper input validation on input which is used as an array index will lead to an out of bounds issue while processing AP find event from f CVE-2018-119287.8Lack of check on length parameter may cause buffer overflow while processing WMI commands in Snapdragon Auto, Snapdragon Compute, Snapdragon CVE-2018-119297.8Lack of input validation in WLAN function can lead to potential heap overflow in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Indust CVE-2018-11935.3Cloud Foundry routing-release, versions prior to 0.175.0, lacks sanitization for user-provided X-Forwarded-Proto headers. A remote user can CVE-2018-119309.8Improper input validation on input data which is used to locate and copy the additional IEs in WLAN function can lead to potential integer t CVE-2018-119317.8Improper access to HLOS is possible while transferring memory to CPZ in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdr