CVE-2022-20352

In addProviderRequestListener of LocationManagerService.java, there is a possible way to learn which packages request location information due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not...

CVE-2022-20348

In updateState of LocationServicesWifiScanningPreferenceController.java, there is a possible admin restriction bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

CVE-2022-20353

In onSaveRingtone of DefaultRingtonePreference.java, there is a possible inappropriate file read due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

PT-2022-14571 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-10 through Android-12L Description: The issue is related to a possible out of bounds read in the updateAudioTrackInfoFromESDS MPEG4Audio function of MPEG4Extractor.cpp. This could lead to remote information disclosure...

PT-2022-14569 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-10 through Android-12L Description: A race condition in the stealReceiveChannel of EventThread.cpp could allow interference with process communication, potentially leading to local escalation of privilege without...

Google Android 安全漏洞

Google Android is a Linux-based open source operating system from Google, Inc. A security vulnerability exists in the Google Android Open Source Project AOSP, which stems from a vulnerability that allows an attacker to remotely execute code via Bluetooth without additional privileges. The followi...

CVE-2022-20223

In assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible way to start a phone call without permissions due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

CVE-2022-20225

In getSubscriptionProperty of SubscriptionController.java, there is a possible read of a sensitive identifier due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

CVE-2022-20223

In assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible way to start a phone call without permissions due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

CVE-2022-20225

In getSubscriptionProperty of SubscriptionController.java, there is a possible read of a sensitive identifier due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

PT-2022-14455 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-10 through Android-12L Description: The issue is related to improper input validation in the choosePrivateKeyAlias function of KeyChain.java, which could lead to local information disclosure. User interaction is...

CVE-2022-20177

Product: AndroidVersions: Android kernelAndroid ID: A-209906686References: N/A...

CVE-2022-20179

Product: AndroidVersions: Android kernelAndroid ID: A-211683760References: N/A...

CVE-2022-20184

Product: AndroidVersions: Android kernelAndroid ID: A-209153114References: N/A...

CVE-2022-20168

Product: AndroidVersions: Android kernelAndroid ID: A-210594998References: N/A...

CVE-2022-20188

Product: AndroidVersions: Android kernelAndroid ID: A-207254598References: N/A...

CVE-2022-20138

In ACTIONMANAGEDPROFILEPROVISIONED of DevicePolicyManagerService.java, there is a possible way for unprivileged app to send MANAGEDPROFILEPROVISIONED intent due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User...

CVE-2022-20151

Product: AndroidVersions: Android kernelAndroid ID: A-210712565References: N/A...

CVE-2022-20149

Product: AndroidVersions: Android kernelAndroid ID: A-211685939References: N/A...

CVE-2022-20127

In cet4tdatacback of cet4t.cc, there is a possible out of bounds write due to a double free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12...