CVE-2023-20969

CVE-2023-20969 describes an out-of-bounds read in multiple locations of p2p_iface.cpp, leading to possible local information disclosure with system execution privileges required. The Android 13 context is documented, with impact on confidentiality (C:H) and no required user interaction. The issue...

CVE-2023-20988

CVE-2023-20988 affects Android-13 Bluetooth stack via function btm_read_rssi_complete in btm_acl.cc, where a missing bounds check allows an out-of-bounds read that could lead to local information disclosure. Exploitation is described as requiring System execution privileges with no user interacti...

CVE-2023-20993

CVE-2023-20993 affects Android 11–13 via SnoozeHelper.java, where an uncaught exception can cause a failure to persist settings, enabling local elevation of privilege with no extra execution privileges and no user interaction required. The vulnerability is documented across multiple sources (NVD,...

CVE-2023-20995

CVE-2023-20995 concerns a logic error in the Fingerprint workflow within Android 13. In code path captureImage of CustomizedSensor.cpp, the flaw can bypass fingerprint unlock, enabling local elevation of privilege without additional execution privileges and without user interaction. Affected prod...

CVE-2023-21013

CVE-2023-21013 is an out-of-bounds read in hostapd.cpp (forceStaDisconnection) on Android 13. The vulnerability could allow local information disclosure with system-level privileges and requires no user interaction. Connected sources consistently describe the issue without public exploit details....

CVE-2023-21030

The CVE-2023-21030 entry describes a memory corruption vulnerability due to a double free in keystore_cli_v2.cpp, enabling local privilege escalation in Android 13 with no user interaction required. Affected software in the connected data includes Google Pixel security advisories and Pixel bullet...

CVE-2023-21034

CVE-2023-21034 affects Android 13 devices, with the vulnerability located in multiple SensorService.cpp functions where a permissions bypass may allow access to accurate sensor data, causing local privilege escalation. The issue is described as needing low privileges and no user interaction, with...

CVE-2023-20963

In WorkSource, there is a possible parcel mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-220302519 Recent...

PT-2023-17816

Name of the Vulnerable Software and Affected Versions Android version Android-13 Description In the updateInputChannel function of WindowManagerService.java, a logic error allows setting a touchable region beyond its own SurfaceControl. This could lead to local denial of service without needing...

PT-2023-17791

Name of the Vulnerable Software and Affected Versions Android versions Android-13 Description In the onContextItemSelected method of NetworkProviderSettings.java, a missing permission check allows users to change the Wi-Fi settings of other users. This could lead to local escalation of privilege...

PT-2023-17808

Name of the Vulnerable Software and Affected Versions Android versions Android-13 Description The issue is related to a possible out of bounds write due to a use after free in the UnwindingWorker of unwinding.cc. This could lead to local escalation of privilege, requiring System execution...

PT-2023-17807

Name of the Vulnerable Software and Affected Versions Android versions Android-13 Description The issue is related to improper input validation in the InstallStart.java file, allowing for a possible change in the installer package name. This could lead to local escalation of privilege, requiring...

PT-2023-17812

Name of the Vulnerable Software and Affected Versions Android version Android-13 Description In the isTargetSdkLessThanQOrPrivileged function of WifiServiceImpl.java, there is a possible way for the guest user to change admin user network settings due to a missing permission check. This could lea...

PT-2023-17826

Name of the Vulnerable Software and Affected Versions Android versions Android-13 Description The issue is related to a permissions bypass in multiple functions of BackupHelper.java. This could allow an app to obtain permissions previously granted to another app with the same package name, leadin...

CVE-2023-21013

In forceStaDisconnection of hostapd.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID:...

PT-2023-17814

Name of the Vulnerable Software and Affected Versions Android versions Android-13 Description The issue is related to a logic error in the maybeFinish function of FallbackHome.java, which could cause a delay in the lockdown screen. This delay could lead to a local escalation of privilege without...

CVE-2023-21026

In updateInputChannel of WindowManagerService.java, there is a possible way to set a touchable region beyond its own SurfaceControl due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for...

CVE-2023-21007

In multiple locations of p2piface.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID:...

CVE-2023-21018

In UnwindingWorker of unwinding.cc, there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-23333856...

CVE-2023-20983: Out-of-bounds Read

In btmblerandenccomplete of btmble.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID:...