CVE-2018-11961

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Possibility of accessing out of bound vector index When updating some GNSS configurations.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
Qualcomm, Inc.	Android for MSM, Firefox OS for MSM, QRD Android	All Android releases from CAF using the Linux kernel

References

http://www.securityfocus.com/bid/106136Third Party Advisory, VDB Entry
https://www.codeaurora.org/security-bulletin/2018/12/03/december-2018-code-aurora-security-bulletinPatch, Third Party Advisory
http://www.securityfocus.com/bid/106136Third Party Advisory, VDB Entry
https://www.codeaurora.org/security-bulletin/2018/12/03/december-2018-code-aurora-security-bulletinPatch, Third Party Advisory

Timeline

Published: Dec 20, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-119627.8In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Use-after-free issue in heap whil CVE-2018-119637.8In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Buffer overread may occur due to CVE-2018-119647.8In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Exposing the hashed content in /e CVE-2018-119657.8In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Anyone can execute proptrigger.sh CVE-2018-119667.8Undefined behavior in UE while processing unknown IEI in OTA message in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdr CVE-2018-119677.8Signature verification of the skel library could potentially be disabled as the memory region on the remote subsystem in which the library i CVE-2018-119687.8Improper check before assigning value can lead to integer overflow in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdrag CVE-2018-11978.5In Windows Stemcells versions prior to 1200.14, apps running inside containers in Windows on Google Cloud Platform are able to access the me CVE-2018-119707.8TZ App dynamic allocations not protected from XBL loader in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivit CVE-2018-119715.5Interrupt exit code flow may undermine access control policy set forth by secure world can lead to potential secure asset leakage in Snapdra CVE-2018-119765.5ECDSA signature code leaks private keys from secure world to non-secure world in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivit CVE-2018-11988.8Pivotal Cloud Cache, versions prior to 1.3.1, prints a superuser password in plain text during BOSH deployment logs. A malicious user with a