PT-2020-11705

Name of the Vulnerable Software and Affected Versions Android versions Android-11 Description The issue is related to a permissions bypass due to SQL injection in MediaProvider. This could lead to local information disclosure without requiring additional execution privileges. User interaction is...

PT-2020-11727

Name of the Vulnerable Software and Affected Versions Android versions Android-11 Description The issue is related to an unsafe PendingIntent in NFC, which could allow a permission bypass. This might lead to a local escalation of privilege, requiring User execution privileges. Notably, user...

PT-2020-11719

Name of the Vulnerable Software and Affected Versions Android versions Android-11 Description The issue is related to a tapjacking vulnerability in the PackageInstaller, which could lead to a local escalation of privilege. This can occur when an app is set as the default Assist app and has User...

PT-2020-11711

Name of the Vulnerable Software and Affected Versions Android versions Android-11 Description The issue is related to a possible use after free due to a race condition in SurfaceFlinger. This could lead to local escalation of privilege, requiring System execution privileges. User interaction is n...

PT-2020-11674

Name of the Vulnerable Software and Affected Versions Android versions Android-11 Description The issue is related to a possible out of bounds write in the mp3 extractor due to uninitialized data. This could potentially lead to remote code execution without requiring additional execution...

PT-2020-11647

Name of the Vulnerable Software and Affected Versions Android versions Android-11 Description The issue concerns a missing permission check in Java network APIs, potentially allowing access to sensitive network state. This could lead to local information disclosure without requiring additional...

CVE-2020-0333: Improper Input Validation

In UrlQuerySanitizer, there is a possible improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-73822755...

CVE-2020-0267: Externally Controlled Reference to a Resource in Another Sphere

In WindowManager, there is a possible launch of an unexpected app due to a confused deputy. This could lead to local escalation of privilege due to launching a malicious app instead of the one the user intended, with no additional execution privileges needed. User interaction is needed for...

CVE-2020-0358: Time-of-check Time-of-use (TOCTOU) Race Condition

In SurfaceFlinger, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-150227563...

CVE-2020-0312: Undefined Security Weakness

In Battery Saver, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-153879099...

PT-2020-11716

Name of the Vulnerable Software and Affected Versions Android versions Android-11 Description The issue is related to a possible resource exhaustion in libmedia due to improper input validation. This could lead to a remote denial of service, and no additional execution privileges are needed. User...

CVE-2020-0344: Improper Neutralization of Special Elements used in an SQL Command

In MediaProvider, there is a possible permissions bypass due to SQL injection. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-140729887...

CVE-2020-0343: Missing Authorization

In NetworkStatsService, there is a possible access to protected data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID:...

CVE-2020-0373: Out-of-bounds Read

In SoundTriggerHwService, there is a possible out of bounds read due to a race condition. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-146894086...

CVE-2020-0337: Undefined Security Weakness

In MediaProvider, there is a possible bypass of a permissions check due to a confused deputy. This could lead to local information disclosure, with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-124329382...

PT-2020-11693

Name of the Vulnerable Software and Affected Versions Android versions Android-11 Description The issue is related to a possible information disclosure in the libcodec2 soft mp3dec component due to uninitialized data. This could lead to remote information disclosure without requiring additional...

PT-2020-11689

Name of the Vulnerable Software and Affected Versions Android versions Android-11 Description The issue is related to possible memory corruption due to type confusion in SurfaceFlinger. This could lead to local escalation of privilege, requiring System execution privileges. User interaction is no...

CVE-2020-0340: Use of Uninitialized Resource

In libcodec2softmp3dec, there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-144901522...

CVE-2020-0366: Improper Restriction of Rendered UI Layers or Frames

In PackageInstaller, there is a possible permissions bypass due to a tapjacking vulnerability. This could lead to local escalation of privilege using an app set as the default Assist app with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions:...

CVE-2020-0362: Improper Input Validation

In libstagefright, there is a possible resource exhaustion due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-123237930...