491 matches found
CVE-2023-21094
In sanitize of LayerState.cpp, there is a possible way to take over the screen display and swap the display content due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...
CVE-2023-20926
In onParentVisible of HeaderPrivacyIconsController.kt, there is a possible way to bypass factory reset protections due to a missing permission check. This could lead to local escalation of privilege with physical access to a device that's been factory reset with no additional execution privileges...
PT-2023-18645 · Unknown · Wpmobile.App
Name of the Vulnerable Software and Affected Versions: WPMobile.App versions = 11.13 Description: A Cross-Site Scripting XSS vulnerability has been discovered in the WPMobile.App plugin for Android and iOS mobile applications, affecting versions up to and including 11.13. This issue allows for XS...
SUSE CVE-2014-9892
The sndcomprtstamp function in sound/core/compressoffload.c in the Linux kernel through 4.7, as used in Android before 2016-08-05 on Nexus 5 and 7 2013 devices, does not properly initialize a timestamp data structure, which allows attackers to obtain sensitive information via a crafted applicatio...
SUSE CVE-2014-9900
The ethtoolgetwol function in net/core/ethtool.c in the Linux kernel through 4.7, as used in Android before 2016-08-05 on Nexus 5 and 7 2013 devices, does not initialize a certain data structure, which allows local users to obtain sensitive information via a crafted application, aka Android...
SUSE CVE-2017-5079
Inappropriate implementation in Blink in Google Chrome prior to 59.0.3071.86 for Mac, Windows, and Linux, and 59.0.3071.92 for Android, allowed a remote attacker to display UI on a non attacker controlled tab via a crafted HTML page...
CVE-2022-20235
The PowerVR GPU kernel driver maintains an "Information Page" used by its cache subsystem. This page can only be written by the GPU driver itself, but prior to DDK 1.18 however, a user-space program could write arbitrary data to the page, leading to memory corruption issues.Product:...
CVE-2022-4457 WARP client manifest misconfiguration leading to Task Hijacking
Due to a misconfiguration in the manifest file of the WARP client for Android, it was possible to a perform a task hijacking attack. An attacker could create a malicious mobile application which could hijack legitimate app and steal potentially sensitive information when installed on the victim's...
Android Security Bulletin—January 2023Stay organized with collectionsSave and categorize content based on your preferences.
The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Security patch levels of 2023-01-05 or later address all of these issues. To learn how to check a device's security patch level, see Check and update your Android version. Android partners are...
EarSpy Attack Can Use Motion Sensors Data to Pry on Android Devices
By Deeba Ahmed An EarSpy attack is a proof of concept of a new type of attack on Android devices that exposes users to eavesdropping. This is a post from HackRead.com Read the original post: EarSpy Attack Can Use Motion Sensors Data to Pry on Android Devices...
Millions of Android Devices Still Don't Have Patches for Mali GPU Flaws
A set of five medium-severity security flaws in Arm's Mali GPU driver has continued to remain unpatched on Android devices for months, despite fixes released by the chipmaker. Google Project Zero, which discovered and reported the bugs, said Arm addressed the shortcomings in July and August 2022...
Mind the Gap
By Ian Beer, Project Zero Note: The vulnerabilities discussed in this blog post CVE-2022-33917 are fixed by the upstream vendor, but at the time of publication, these fixes have not yet made it downstream to affected Android devices including Pixel, Samsung, Xiaomi, Oppo and others. Devices with ...
CVE-2022-40703
CWE-302 Authentication Bypass by Assumed-Immutable Data in AliveCor Kardia App version 5.17.1-754993421 and prior on Android allows an unauthenticated attacker with physical access to the Android device containing the app to bypass application authentication and alter information in the app...
The vulnerability of Keybase’s open-source key catalog for iOS and Android clients stems from incomplete cleanup of temporary or auxiliary resources. This allows attackers to expose protected information or cause service failures.
The vulnerability of Keybase’s open-source key catalog for iOS and Android exists due to incomplete cleanup of temporary or auxiliary resources. Exploiting this vulnerability could allow a malicious actor to disclose protected information or cause service failures...
CVE-2022-20440
In Messaging, There has unauthorized broadcast, this could cause Local Deny of Service.Product: AndroidVersions: Android SoCAndroid ID: A-242259918...
CVE-2022-20439
In Messaging, There has unauthorized provider, this could cause Local Deny of Service.Product: AndroidVersions: Android SoCAndroid ID: A-242266172...
CVE-2022-20437
In Messaging, There has unauthorized broadcast, this could cause Local Deny of Service.Product: AndroidVersions: Android SoCAndroid ID: A-242258929...
CVE-2022-20438
In Messaging, There has unauthorized broadcast, this could cause Local Deny of Service.Product: AndroidVersions: Android SoCAndroid ID: A-242259920...