PT-2023-18134 · Google · Uwb

Name of the Vulnerable Software and Affected Versions: UWB Google affected versions not specified Description: The issue allows a malicious app to masquerade as the system app com.android.uwb.resources due to improperly used crypto. This could lead to local escalation of privilege with no...

PT-2023-27271 · Google · Android

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is related to a missing bounds check in the collapse of canonicalize md.c, which could lead to a possible out of bounds read. This may result ...

PT-2023-18145 · Unknown · Security Element Api

Name of the Vulnerable Software and Affected Versions: Security Element API affected versions not specified Description: The issue is related to an integer overflow in the Security Element API, which can cause an out of bounds write. This could lead to local escalation of privilege, with System...

PT-2023-18074 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions prior to the fixed version Description: The issue is related to a missing null check in the SliceManagerService, which could allow an attacker to check if a content provider is installed. This could lead to local information...

PT-2023-18151 · Telephony · Telephony

Name of the Vulnerable Software and Affected Versions: Telephony affected versions not specified Description: The issue is related to a logic error in the code of Telephony, which allows for the retrieval of the ICCID. This could lead to local information disclosure without requiring additional...

PT-2023-18109 · Unknown · Text Services

Name of the Vulnerable Software and Affected Versions: In Text Services affected versions not specified Description: The issue allows determining whether an app is installed without query permissions due to side channel information disclosure. This could lead to local information disclosure with ...

CVE-2023-21303: Observable Discrepancy

In Content, here is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2023-18152 · Unknown · Selinux-Policy

Name of the Vulnerable Software and Affected Versions: SELinux Policy affected versions not specified Description: In SELinux Policy, there is a possible restriction bypass due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed...

PT-2023-18095 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android affected versions not specified Description: The issue is related to a side channel information disclosure in the UsageStatsService, which could allow reading installed 3rd party apps. This leads to local information disclosure withou...

CVE-2023-21376: Improper Privilege Management

In Telephony, there is a possible way to retrieve the ICCID due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2023-18122 · Unknown · Device Idle Controller

Name of the Vulnerable Software and Affected Versions: Device Idle Controller affected versions not specified Description: The issue allows determining whether an app is installed without query permissions due to side channel information disclosure. This could lead to local information disclosure...

CVE-2023-21353: Out-of-bounds Read

In NFA, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-21342: Undefined Security Weakness

In RemoteSpeechRecognitionService of RemoteSpeechRecognitionService.java, there is a possible way to launch an activity from the background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not...

PT-2023-18142 · Scudo · Scudo

Name of the Vulnerable Software and Affected Versions: Scudo affected versions not specified Description: The issue is related to an insecure implementation or design in Scudo, which could lead to the exploitation of certain heap out-of-bounds OOB read/write issues. This might result in local...

PT-2023-18076 · Sepolicy · Sepolicy

Name of the Vulnerable Software and Affected Versions: SEPolicy affected versions not specified Description: The issue is related to a permissions bypass in SEPolicy, allowing access to the factory MAC address. This could lead to local information disclosure, with System execution privileges...

PT-2023-18127 · Unknown · Activity Manager

Name of the Vulnerable Software and Affected Versions: Activity Manager affected versions not specified Description: The issue is caused by a logic error in the code, allowing for a possible background activity launch. This could lead to local escalation of privilege with no additional execution...

PT-2023-18117 · Unknown · Permission Manager

Name of the Vulnerable Software and Affected Versions: Permission Manager affected versions not specified Description: In Permission Manager, there is a possible way to bypass required permissions due to a missing permission check. This could lead to local escalation of privilege with no addition...

PT-2023-18089 · Core · Core

Name of the Vulnerable Software and Affected Versions: Core affected versions not specified Description: The issue is related to a missing permission check that allows calls to be forwarded without the user's knowledge. This could lead to local escalation of privilege with no additional execution...

CVE-2023-40131

In GpuService of GpuService.cpp, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-40140

In androidviewInputDevicecreate of androidviewInputDevice.cpp, there is a possible way to execute arbitrary code due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...