CVE-2018-9587

CVE-2018-9587 affects Android 7.0–9 (Android-7.0, -7.1.1, -7.1.2, -8.0, -8.1, -9). In ContactPhotoUtils.java (savePhotoFromUriToUri), a confused deputy scenario could allow unauthorized access to files in the Contacts app, enabling local elevation of privilege. The vulnerability is local (attack ...