CVE-2018-11293

CVE-2018-11293 affects Qualcomm WLAN Host in Android variants built on CAF Linux kernel (Android for MSM, Firefox OS for MSM, QRD Android). The issue arises in wma_ndp_confirm_event_handler and wma_ndp_indication_event_handler where ndp_cfg_len and num_ndp_app_info are taken from firmware without...

CVE-2018-11964

CVE-2018-11964 affects Android builds (Android for MSM, Firefox OS for MSM, QRD Android) using CAF Linux kernels. Root cause: exposure of hashed content in /etc/passwd, enabling a local attacker to access credentials and potentially escalate privileges; impact described as complete confidentialit...

CVE-2018-11965

Technical details about CVE-2018-11965 are not publicly provided in the connected documents. Available entries repeat the vulnerability description without concrete affected products, versions, root cause, or fixes. Monitor for updates from official advisories.

CVE-2018-21064

The CVE-2018-21064 entry concerns Samsung mobile devices running N(7.x)/O(8.x) software, where an array overflow exists in a driver’s input booster (Samsung SVE-2017-11816). The issue is documented across multiple feeds, with high-severity metrics (CVSS v3.1 base score 9.8, impact on confidential...

CVE-2018-21073

The CVE-2018-21073 entry affects Samsung mobile devices running N(7.x) and O(8.0) on Galaxy S9+/S9/S8+/S8/Note 8. The root issue is access to clipboard content in the locked state via the Edge panel, enabling potential information disclosure without unlocking the device. If present in connected d...

CVE-2018-21076

CVE-2018-21076 concerns Samsung mobile devices with N(7.x) Exynos8890/8895 SoCs, where a modified trustlet in the Secure Driver can disclose a KASLR offset. The core issue is information disclosure rather than code execution, with a local access vector implied by the need to interact with the Sec...

CVE-2018-21089

CVE-2018-21089 affects Samsung mobile devices running N(7.x) on MT6755/MT6757 Mediatek chipsets. The root cause is an integer overflow in the bootloader related to the download offset control, enabling arbitrary code execution. The entry notes a Samsung ID SVE-2017-10732 (Jan 2018). Impact is des...

CVE-2018-5904

CVE-2018-5904 describes a use-after-free vulnerability in the LPM status driver within CAF Linux kernel branches used by Android for MSM, Firefox OS for MSM, and QRD Android. The flaw arises during list traversal for cleanup, enabling a local attacker to potentially exploit the condition. The NVD...

CVE-2018-5909

CVE-2018-5909 is documented as a buffer overflow affecting the Rotator component in Qualcomm, reported in Android CAF builds. The vulnerability arises from a lack of proper buffer-size checking in display handling code, which may permit memory corruption. The CVE is listed under Qualcomm componen...

CVE-2018-9344

The CVE-2018-9344 entry describes a use-after-free in DescramblerImpl.cpp caused by improper locking, enabling local privilege escalation with no extra privileges and no user interaction. Connected sources associate this issue with Android’s Media framework and list affected context in the Androi...

CVE-2018-9452

CVE-2018-9452 affects the Android Framework, tied to getOffsetForHorizontal in Layout.java, causing a possible application hang/DoS from wide inputs with hidden Unicode characters. The issue affects Android 7.0–9.0 and requires user interaction for exploitation; patches were issued for the 2018-1...

CVE-2018-9485

CVE-2018-9485 affects the Android Bluetooth stack: in l2cble_process_sig_cmd of l2c_ble.cc there is an out-of-bounds read caused by a missing bounds check. This could lead to remote information disclosure over Bluetooth with no user interaction or extra privileges required. Attack vector is adjac...

CVE-2018-9490

The CVE-2018-9490 issue affects Android, specifically the CollectValuesOrEntriesImpl function in elements.cc. The root cause is a type confusion that can enable remote code execution, leading to remote escalation of privilege. The vulnerability is exploitable with user interaction and has a local...

CVE-2018-9506

CVE-2018-9506: In avrc_msg_cback of avrc_api.cc there is an out-of-bounds read due to a missing bounds check, enabling remote information disclosure over Bluetooth with no extra privileges. Affected: Android versions listed in the NVD entry (7.0–9.0). The connected documents confirm the root caus...

CVE-2018-9511

CVE-2018-9511 affects Android 9.0 and relates to ipSecSetEncapSocketOwner in XfrmController.cpp. The issue is a potential failure to initialize a security feature due to uninitialized data, which could enable local denial of service (DoS) on IPsec sockets without additional privileges or user int...

CVE-2019-20550

CVE-2019-20550 affects certain Samsung mobile devices running O(8.x) software (China/India releases). The issue, described across multiple sources, is that the S Secure app can access the contents of a locked application without requiring a password. The Red Hat and NVD entries mirror this descri...

CVE-2019-20561

CVE-2019-20561 refers to a vulnerability in Samsung mobile devices with N(7.x), O(8.x), and P(9.0) Exynos chipsets where the bootloader contains an integer signedness error (Samsung ID SVE-2019-15230). Public documents across NVD and Red Hat cite the same issue; no product-specific exploit detail...

CVE-2019-20573

CVE-2019-20573 affects Samsung mobile devices running N(7.x), O(8.x) and P(9.0). The issue is local SQL injection in the RCS Content Provider, with Samsung repair IDs SVE-2019-14059 and SVE-2019-14685 (August 2019). The NVD CVSS data indicates a high impact (CVSS3.1: Local, Privileges Required Lo...

CVE-2019-20601

CVE-2019-20601 affects Samsung mobile devices running N(7.x), O(8.x), and P(9.0) with Exynos 7570/7580/7870/7880/8890, where RKP memory corruption results in an arbitrary write to protected memory. The issue, tracked under Samsung ID SVE-2019-13921-2 (May 2019), is documented across multiple sour...

CVE-2019-2069

CVE-2019-2069 affects Android 10 via a vulnerability in libxaac caused by a missing bounds check, leading to an out-of-bounds write that could cause remote code execution. The description states user interaction is required for exploitation. Connected documentation confirms the issue exists in li...

CVE-2019-20778

Summary: CVE-2019-20778 affects LG Android devices (versions 7.0–9.0) with the Backup subsystem failing to properly restrict operations or validate input. This leads to a potential impact on confidentiality, integrity, and availability as indicated by CVSS metrics (3.1: HIGH/HIGH/HIGH; 2.0: PARTI...

CVE-2019-2120

CVE-2019-2120 affects Android via a vulnerability in OatFileAssistant::GenerateOatFile where an insecure default value can cause file corruption, enabling local elevation of privilege with no additional privileges and without user interaction. Affected are Android 7.0 through 9 (Android-7.0, 7.1....

CVE-2019-2125

CVE-2019-2125 affects Android where in ChangeDefaultDialerDialog.java an overlay attack can lead to local escalation of privilege without additional privileges. The root cause is an overlay-based elevation of privilege that allows a local app to gain higher privileges with user interaction requir...

CVE-2019-2159

CVE-2019-2159 affects the Android 10 libxaac library, with an out-of-bounds write due to a missing bounds check. The vulnerability could allow remote code execution and requires user interaction to exploit. Exploitation details (such as vectors) are not provided in the connected documents, and a ...

CVE-2019-2195

The CVE-2019-2195 issue affects Android, described as an input-validation flaw in tokenize of sqlite3_android.cpp that allows an attacker-controlled INSERT statement. This leads to local elevation of privilege with no additional execution privileges required and no user interaction needed. Produc...

CVE-2019-2204

CVE-2019-2204 affects Android (Android versions 8.1 and 9). The issue is an out-of-bounds read in FindSharedFunctionInfo within objects.cc that can lead to remote code execution in pacprocessor without user interaction. This is a System component vulnerability with ATT&CK-agnostic remote code exe...

CVE-2019-9234

CVE-2019-9234 affects wpa_supplicant_8 on Android 10. The issue is an out-of-bounds read caused by a missing bounds check, enabling remote information disclosure over the network without user interaction. Exploitation details are not provided in the supplied documents. Mitigation/patch informatio...

CVE-2019-9258

This CVE-2019-9258 entry concerns Android 10 (wifilogd) with a possible out-of-bounds write due to a missing bounds check, enabling local elevation of privilege without user interaction. The issue affects wifilogd on Android-10 and is described as an out-of-bounds write that could elevate privile...

CVE-2019-9262

CVE-2019-9262 affects the MPEG4Extractor component in Android 10 media extraction. The issue is an out-of-bounds write caused by an integer overflow in MPEG4Extractor, potentially enabling remote code execution in the media extractor. Exploitation requires user interaction. Impact stated as RCE w...

CVE-2019-9293

CVE-2019-9293 affects Android 10, describing an out-of-bounds read in libstagefright due to a missing bounds check. This could allow remote information disclosure with no execution privileges, though exploitation requires user interaction. The vulnerability is documented across multiple sources (...

CVE-2019-9316

CVE-2019-9316 affects Android’s media stack via the libstagefright component, where a missing variable initialization is cited as the root cause. This flaw could enable remote information disclosure without extra privileges, with user interaction required for exploitation. Affected product is And...

CVE-2019-9350

CVE-2019-9350 corresponds to an Elevation of Privilege in Android 10 Keymaster, caused by a use-after-free in a component handling crypto operations. This vulnerability could allow a local attacker to escalate privileges without additional execution privileges or user interaction, as described ac...

CVE-2019-9407

CVE-2019-9407 affects the Android 10 Framework (notification management) and enables a local elevation of privilege by bypassing notification permissions, allowing a user-impacting privilege gain without user interaction. The issue is categorized as EoP with high impact (confidentiality, integrit...

CVE-2019-9428

CVE-2019-9428 affects the Android Framework. The issue arises from BROWSEABLE intents that can allow remote disclosure of sensitive URLs, with exploitation requiring user interaction. Affected product/version: Android 10 (Android Framework). Root cause: abuse of BROWSEABLE intents enabling inform...

CVE-2020-0031

Technical details for CVE-2020-0031 are not publicly provided in the supplied documents. Monitor for updates.

CVE-2020-0083

The CVE-2020-0083 issue affects Android 10 where a logic error in setRequirePmfInternal within sta_network.cpp can cause a default value to be misapplied, enabling a remote DoS without user interaction. The Pixel bulletin and Android bulletin indicate this belongs to the System component with a D...

CVE-2020-0126

CVE-2020-0126 affects Android 10 and is described across multiple sources as a use-after-free caused by a race in DrmPlugin.cpp. The vulnerability could enable local code execution with System privileges and does not require user interaction. The Connected documents confirm the issue and its Andr...

CVE-2020-0152

CVE-2020-0152 affects Android 10 and is tied to the function avb_vbmeta_image_verify in avb_vbmeta_image.c . The root cause is a missing bounds check that enables an out-of-bounds read, leading to possible information disclosure with system-level privileges; exploitation does not require user int...

CVE-2020-0155

CVE-2020-0155 affects Android 10, specifically in the NFC HAL code path: phNxpNciHal_send_ese_hal_cmd in phNxpNciHal_ext.cc. The root cause is a missing bounds check that enables an out-of-bounds write. Impact per the description is local elevation of privilege with user privileges required; expl...

CVE-2020-0235

CVE-2020-0235 affects Android’s kernel, specifically the crus_sp_shared_ioctl path where 4 bytes are copied from userdata into the size variable and then used as the size for copy_from_user, overwriting memory following crus_sp_hdr (a static struct crus_sp_ioctl_header). This memory corruption ca...

CVE-2020-0236

CVE-2020-0236 affects Android 10 and specifically the A2DP_GetCodecType path in the a2dp_codec_config. The issue is an out-of-bounds read caused by improper input validation, leading to possible remote information disclosure without extra execution privileges and without user interaction. The vul...

CVE-2020-0276

CVE-2020-0276 affects Android 11 in the Telephony component, where a missing permission check allows a local information disclosure without extra execution privileges. The issue is exploitable locally, with no user interaction required, according to the description. Impact is partial confidential...

CVE-2020-0360

CVE-2020-0360 affects Android 11, involving a permissions bypass in Notification Access Confirmation that could enable local elevation of privilege with user execution privileges needed. Exploitation requires user interaction. The issue is listed under Android 11 vulnerability details and is addr...

CVE-2020-0474

CVE-2020-0474 affects Android 11 in the Media framework (HalCamera.cpp, HalCamera::requestNewFrame). It is a use-after-free due to a race condition, enabling local elevation of privilege with no extra execution privileges required. Exploitation is local and does not require user interaction. NVD ...

CVE-2020-0495

CVE-2020-0495 is an Android 11 vulnerability affecting the JBig2_SddProc.cpp decode_Huffman path, where an integer overflow can trigger an out-of-bounds write and potential information disclosure. Exploitation is described as local (no user interaction required) with no privileges escalation impl...

CVE-2020-11606

The CVE-2020-11606 entry concerns Samsung mobile devices running Q (10.0). Affected component is information exposure within the Secure Folder’s application preview on a locked device, leading to partial confidentiality impact. The root cause and exact vulnerable code path are not detailed in the...

CVE-2020-25063

CVE-2020-25063 affects LG mobile devices running Android OS 7.2, 8.0, 8.1, 9, and 10. The issue stems from incorrect application-level input validation in an LG component, causing an application crash (LG ID LVE-SMP-200018, July 2020). Documents do not provide additional technical details such as...

CVE-2020-35548

CVE-2020-35548 affects Finder on Samsung mobile devices running Q(10.0). The issue arises from calling a non-existent provider, which allows an attacker to cause a denial of service. Connected sources corroborate the same description; no explicit remediation or patch details are provided in the s...

CVE-2021-0347

The CVE-2021-0347 entry concerns the Android subsystem component “ccu,” where a missing bounds check enables an out-of-bounds read. This could permit local information disclosure with System privileges required, and would require user interaction to exploit. Affected products/versions explicitly ...

CVE-2021-0353

CVE-2021-0353 affects Android 11 via a heap buffer overflow in the kisd component, causing a memory corruption vulnerability. The root cause is heap-based memory corruption leading to local escalation of privilege, requiring system-level privileges for impact; exploitation is described as not req...