description: In all Qualcomm products with Android releases from CAF using the Linux kernel, due to lack of bounds checking on the variable "data_len" from the function WLANQCMBR_McProcessMsg, a buffer overflow may potentially occur in WLANFTM_McProcessMsg.
problem types: Buffer Copy without Checking Size of Input in WLAN
affected:
{
product: Android for MSM, Firefox OS for MSM, QRD Android
vendor: Qualcomm, Inc.
versions:
status: affected, version: All Android releases from CAF using the Linux kernel
}