CVE-2018-13889

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Heap memory was accessed after it was freed

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
Qualcomm, Inc.	Android for MSM, Firefox OS for MSM, QRD Android	All Android releases from CAF using the Linux kernel

References

http://www.securityfocus.com/bid/106496Third Party Advisory, VDB Entry
https://www.codeaurora.org/security-bulletin/2019/01/07/january-2019-code-aurora-security-bulletinPatch, Third Party Advisory
http://www.securityfocus.com/bid/106496Third Party Advisory, VDB Entry
https://www.codeaurora.org/security-bulletin/2019/01/07/january-2019-code-aurora-security-bulletinPatch, Third Party Advisory

Timeline

Published: Feb 11, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-13896.5IBM API Connect 5.0.0.0 through 5.0.8.2 is impacted by generated LoopBack APIs for a Model using the BelongsTo/HasMany relationship allowing CVE-2018-138937.8In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Out of bound mask range access ca CVE-2018-138957.8Due to the missing permissions on several content providers of the RCS app in its android manifest file will lead to an unprivileged access CVE-2018-138967.8XBL_SEC image authentication and other crypto related validations are accessible to a compromised OEM XBL Loader due to missing lock at XBL_CVE-2018-138977.5Clients hostname gets added to DNS record on device which is running dnsmasq resulting in an information exposure in Snapdragon Auto, Snapdr CVE-2018-138989.8Out-of-Bounds write due to incorrect array index check in PMIC in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Conne CVE-2018-138997.8Processing messages after error may result in user after free memory fault in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, CVE-2018-13905.4IBM Financial Transaction Manager for Check Services for Multi-Platform 3.0, 3.0.2, and 3.0.2.1 is vulnerable to cross-site scripting. This CVE-2018-139007.8Use-after-free vulnerability will occur as there is no protection for the route table`s rule in IPA driver in Snapdragon Auto, Snapdragon Co CVE-2018-139015.5Due to missing permissions in Android Manifest file, Sensitive information disclosure issue can happen in PCI RCS app in Snapdragon Auto, Sn CVE-2018-139027.5Out of bounds memory read and access due to improper array index validation may lead to unexpected behavior while decoding XTRA file in Snap CVE-2018-139038.1u'Error in UE due to race condition in EPCO handling' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial