CVE-2022-20319: Externally Controlled Reference to a Resource in Another Sphere

In DreamServices, there is a possible way to launch arbitrary protected activities due to a confused deputy. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID:...

CVE-2022-20309: Observable Discrepancy

In PackageInstaller, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for...

PT-2022-14508 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-13 Description: In Bluetooth, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution over Bluetooth with no additional execution privileges needed. User interactio...

PT-2022-14506 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android version 13 Description: In Core, there is a possible way to start an activity from the background due to a missing permission check. This could lead to local escalation of privilege with User execution privileges needed. User...

CVE-2022-20274: Missing Authorization

In Keyguard, there is a missing permission check. This could lead to local escalation of privilege and prevention of screen timeout with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-206470146...

CVE-2022-20311: Missing Authorization

In Telecomm, there is a possible disclosure of registered self managed phone accounts due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Andro...

CVE-2022-20331: Improper Restriction of Rendered UI Layers or Frames

In the Framework, there is a possible way to enable a work profile without user consent due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions:...

PT-2022-14535 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-13 Description: The issue concerns a possible disclosure of registered self-managed phone accounts due to a missing permission check. This could lead to local information disclosure, with exploitation requiring User...

CVE-2022-20298: Missing Authorization

In ContentService, there is a possible way to check if an account exists on the device due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

CVE-2022-20266: Improper Input Validation

In Companion, there is a possible way to keep a service running with elevated importance without showing foreground service notification due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed fo...

CVE-2022-20304: Observable Discrepancy

In Content, there is a possible way to determinate the user's account due to side channel information disclosure. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID:...

CVE-2022-20318: Observable Discrepancy

In PackageInstaller, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for...

PT-2022-14491 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-13 Description: In RestrictionsManager, there is a possible way to send a broadcast that should be restricted to system apps due to a permissions bypass. This could lead to local escalation of privilege on an enterpri...

PT-2022-14542 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android version Android-13 Description: In SystemUI, a logic error in the code could lead to the unexpected enabling of the external speaker. This issue may result in local information disclosure without requiring additional execution...

PT-2022-14503 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-13 Description: In DevicePolicyManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information...

PT-2022-14514 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-13 Description: In PackageInstaller, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information...

Google Android 安全漏洞

Google Android is a Linux-based open-source operating system from Google, Inc. A security vulnerability exists in Google Android 13, which stems from a vulnerability in its PackageManager that allows an attacker to use side-channel probing to determine whether an application is installed without...

CVE-2022-20341: Missing Authorization

In ConnectivityService, there is a possible bypass of network permissions due to a missing permission check. This could lead to local information disclosure of tethering interfaces with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

CVE-2022-20328: Missing Authorization

In PackageManager, there is a possible way to determine whether an app is installed due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

CVE-2022-20317: Undefined Security Weakness

In SystemUI, there is a possible way to unexpectedly enable the external speaker due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-13Androi...