CVE-2025-48608: Missing Authorization

In isValidMediaUri of SettingsProvider.java, there is a possible cross user media read due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-40117

CVE-2023-40117 affects the Android SettingsProvider.java resetSettingsLocked path and describes a local privilege-escalation via a lockscreen bypass caused by a permissions bypass. The vulnerability enables elevation of privilege with LOCAL attack vector and LOW required privileges, without user ...

Design/Logic Flaw

providers/settings/SettingsProvider.java in Android 6.x before 2016-09-01 and 7.0 before 2016-09-01 allows physically proximate attackers to bypass the SAFEBOOTDISALLOWED protection mechanism and boot to safe mode via the Android Debug Bridge adb tool, aka internal bug 29900345...