CVE-2018-21074

CVE-2018-21074 affects Samsung mobile devices running M(6.x) software on Exynos or Qualcomm chipsets. The issue is information disclosure from a Trustlet via the debug log. The available documents do not specify affected device models, versions, or the exact root cause details beyond the trustlet...

CVE-2018-21080

CVE-2018-21080 affects Samsung mobile devices running N(7.x). A physically proximate attacker can use a magnet to activate NFC and bypass the lockscreen (Samsung ID SVE-2017-10897). Exploitation details, affected models/versions, and fixes are not explicitly provided in the connected documents; o...

CVE-2018-3570

CVE-2018-3570 refers to a vulnerability in the cpuidle driver used by CAF Android builds (Android for MSM, Firefox OS for MSM, QRD Android) that rely on the Linux kernel. The issue arises from incorrect use of the list_for_each macro, which could lead to an untrusted pointer dereference. Connecte...

CVE-2018-3579

The CVE-2018-3579 issue affects the WLAN driver in CAF Android builds (Android for MSM, Firefox OS for MSM, QRD Android) that use the Linux kernel. The root cause is that event->num_entries_in_page, a value received from firmware, is not properly validated, which can lead to a buffer over-read...

CVE-2018-3599

CVE-2018-3599 is a Use-After-Free in Qualcomm Core Services affecting Qualcomm Android for MSM/CAF-based Android builds (Linux kernel pre-2018-04-05 patch). The issue occurs when notifying a DCI client, enabling EoP with high/critical impact per the Android Pixel bulletin. Mitigation is to apply ...

CVE-2018-5827

CVE-2018-5827 affects Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android builds using CAF with Linux kernels older than the 2018-04-05 patch level. The issue is a WLAN buffer overflow occurring while processing an extscan hotlist event. Public references in the CVE indicate a high-seve...

CVE-2018-5831

CVE-2018-5831 affects the KGSL driver in CAF Android builds that use the Linux kernel (Android for MSM, Firefox OS for MSM, QRD Android). The vulnerability stems from a reference counting error that can trigger a Use-After-Free condition. The impact is described in the Android/CAF context as a lo...

CVE-2018-5832

CVE-2018-5832 infers a race condition in a camera driver ioctl handler on CAF Android builds using the Linux kernel (Android for MSM, Firefox OS for MSM, QRD Android). The root cause is a Use-After-Free condition triggered by a race in the driver path prior to the security patch level 2018-06-05....

CVE-2018-5856

CVE-2018-5856 affects the Linux kernel in Qualcomm audio paths (sound/soc/qcom/qdsp6/q6asm.c), caused by a race condition leading to a use-after-free. Vendor-specific Android builds (CAF) on MSM, including Audio components, are affected. The description notes potential kernel panic or other unspe...

CVE-2018-5859

CVE-2018-5859 describes a race-condition–driven use-after-free in the MDSS MDP driver used by CAF Android builds on the Linux kernel, prior to the 2018-07-05 patch level. The issue can trigger a Use After Free condition on affected devices (Android for MSM, Firefox OS for MSM, QRD Android). Affec...

CVE-2018-9362

CVE-2018-9362 affects Android where InboundSmsHandler.java's processMessagePart has improper input validation, enabling remote denial of service with no privileges and no user interaction. Affected products include Android 6.x through 8.1. The connected documents confirm a DoS impact but do not p...

CVE-2018-9438

CVE-2018-9438 affects Android 8.1 (Framework) where devices connected only over WiFi VPN may fail to receive security updates due to incorrect checks, causing local denial of service of security updates. Exploitation requires user interaction; no remote code execution is indicated. The Android Se...

CVE-2018-9451

CVE-2018-9451 affects Android, where DynamicRefTable::load in ResourceTypes.cpp has a missing bounds check causing an out-of-bounds read. This leads to local information disclosure without requiring user interaction. Vulnerable Android versions include 6.0–8.1; patch availability is tied to Andro...

CVE-2018-9454

CVE-2018-9454 affects Android (Android 6.0–8.1). Root cause: in bnep_data_ind of bnep_main.cc, a missing bounds check allows an out-of-bounds read, leading to possible local information disclosure without extra privileges. Impact is information disclosure; exploitation requires local access and d...

CVE-2018-9474

CVE-2018-9474 is a local elevation-of-privilege in Android’s Media Framework, triggered by a serialization/deserialization mismatch in MediaPlayer.writeToParcel. Affected software includes Android 7.0–9; exploited via crafted media content with no user interaction. The issue is documented in the ...

CVE-2018-9503

The CVE-2018-9503 entry describes an out-of-bounds read in rfc_process_mx_message() within rfc_ts_frames.cc, leading to remote information disclosure without requiring privileges or user interaction. Affected software includes Android versions 7.0 through 9.0. The vulnerability’s root cause is a ...

CVE-2018-9528

CVE-2018-9528 affects ixheaacd_over_lap_add1_armv8: in ixheaacd_overlap_add1.s, a missing bounds check allows an out-of-bounds write. This could enable remote code execution on Android 9 (Android-9) with user interaction required for exploitation. The vulnerability is tied to the ixheaacd compone...

CVE-2018-9537

CVE-2018-9537 affects Google Android 9 (Android-9) and is caused by a missing bounds check in CAacDecoder_DecodeFrame within aacdecode.cpp, leading to a possible out-of-bounds write. The consequence is remote code execution in the media server with no additional execution privileges, requiring us...

CVE-2018-9559

CVE-2018-9559: In persist_set_key and related cryptfs.cpp functions, there is an out-of-bounds write caused by an uncaught error, enabling local elevation of privilege without user interaction on Android 7.0–9. No exploitation details are provided. The Android Security Bulletin indicates patches ...

CVE-2018-9570

CVE-2018-9570 affects Android 9 and involves an out-of-bounds write in impd_parse_drc_ext_v1 within impd_drc_dynamic_payload.c. The root cause is missing bounds checking in this function, which could allow remote code execution with a local attacker?no, this CVE entry states remote code execution...

CVE-2018-9587

CVE-2018-9587 affects Android 7.0–9 (Android-7.0, -7.1.1, -7.1.2, -8.0, -8.1, -9). In ContactPhotoUtils.java (savePhotoFromUriToUri), a confused deputy scenario could allow unauthorized access to files in the Contacts app, enabling local elevation of privilege. The vulnerability is local (attack ...

CVE-2019-2052

CVE-2019-2052 : In VisitPointers of heap.cc, Android’s System component, there is a potential out-of-bounds read caused by type confusion. This could enable remote information disclosure without extra execution privileges or user interaction. Affected Android versions include 7.0, 7.1.1, 7.1.2, 8...

CVE-2019-20533

CVE-2019-20533 affects Samsung mobile devices running N(7.x), O(8.x), and P(9.0) (China/India releases). The issue: the S Secure app can launch masked apps without a password. Root cause and technical specifics beyond this summary are not provided in the connected documents. The entry references ...

CVE-2019-20570

CVE-2019-20570 affects Samsung mobile devices running Android versions P (9.0), O (8.0), and N (7.1), where attackers can bypass Factory Reset Protection (FRP) using Smart Switch. The Red Hat, ENISA, CNVD, and other connected feeds corroborate the same FRP-bypass issue, identifying the Samsung ID...

CVE-2019-20571

The CVE-2019-20571 entry describes a type confusion vulnerability in the WVDRM Trustlet on Samsung mobile devices running O(8.x) with TEEGRIS, allowing arbitrary code execution. Affected component: WVDRM Trustlet; root cause: type confusion. Impact: arbitrary code execution with high severity (pe...

CVE-2019-20579

Samsung reports a vulnerability in the Gallery app on Galaxy devices running N(7.x), O(8.x), and P(9.0) that allows attackers to enable location information sharing from the lock screen. The entry references Samsung ID SVE-2019-14462 (August 2019). No concrete exploit details, affected specific m...

CVE-2019-20597

CVE-2019-20597 affects Samsung mobile devices running N(7.1), O(8.x), and P(9.0). The vulnerability exists in the SPENgesture component, which can allow arbitrary applications to read or modify user-input logs. This impacts confidentiality and integrity (CVSSv3.1: 9.1, CRITICAL; CVSSv2: 6.4, MEDI...

CVE-2019-20599

Technical details for CVE-2019-20599 are not publicly available in the provided documents. The connected sources repeat the same description without concrete exploit, impact, vulnerable components, or fixes. Monitor for updates from official advisories.

CVE-2019-20616

Technical details (affected component, root cause, version-specific impact, or fixes) are not publicly provided in the connected documents. Monitor for updates from Samsung and security advisories.

CVE-2019-20617

The CVE-2019-20617 entry describes a vulnerability in Samsung mobile devices running P (9.0) software where the Secure Folder leaks preview data of recently used apps. Affected software is Samsung mobile devices with P(9.0); exact component/file, root cause, and vulnerable version details are not...

CVE-2019-2122

CVE-2019-2122 affects Android 7.0–9, describing a local privilege-escalation in LockTaskController.lockKeyguardIfNeeded due to a differing default-case handling between WindowManager and Settings. Impact: potential elevation of privileges with user interaction required; exploitability is local. C...

CVE-2019-2140

CVE-2019-2140 affects libxaac in Android 10, stemming from uninitialized data that can cause information disclosure. Impact: partial confidentiality loss with no full compromise; exploitation requires user interaction. Affected component is libxaac in Android 10, with Android’s release notes indi...

CVE-2019-2164

CVE-2019-2164 affects Android 10 due to an out-of-bounds read in libxaac caused by a missing bounds check. This could disclose information without full execution privileges; exploitation requires user interaction. The Red Hat entry confirms the same description; no patch/version details are provi...

CVE-2019-2191

CVE-2019-2191 affects LG’s LAF component, exposing information from a protected disk partition due to a missing bounds check. This permits local information disclosure via USB with no user interaction; exploitation requires user privileges and is possible without user action. The related Red Hat/...

CVE-2019-2192

CVE-2019-2192 corresponds to a local elevation of privilege in the Android Framework (SliceProvider.java). Affected: Android 9 and 10. Description states a permissions bypass due to improper input validation, enabling a local attacker to gain additional permissions without user interaction. Impac...

CVE-2019-2199

CVE-2019-2199 affects Android 10, where in PackageInstallerService.java’s createSessionInternal a permissions bypass could enable local elevation of privilege to System level. No exploitation details are provided beyond that; impact is local and requires no user interaction. The Android Security ...

CVE-2019-2209

CVE-2019-2209 affects Android components (BTA_DmPinReply in bta_dm_api.cc). The issue is an out-of-bounds read caused by an incorrect bounds check, leading to local information disclosure with user privileges, no user interaction required. Affected Android versions: 8.0–10.0. Connected Red Hat/NT...

CVE-2019-2210

CVE-2019-2210 affects Android 9–10 where the qmi_vs_service.cc load_logging_config path can trigger an out-of-bounds write caused by a heap buffer overflow, enabling local privilege escalation without user interaction. Public sources (NVD/Red Hat/NVD list, Pixel bulletin) identify this as a Local...

CVE-2019-9268

CVE-2019-9268 affects Android’s media stack (libstagefright) with a use-after-free caused by improper locking, enabling local escalation of privilege in the media server without extra privileges. The issue is tied to Android 10 (Android-10) and is documented in the Android 10 Security Release Not...

CVE-2019-9285

CVE-2019-9285 describes an out-of-bounds read in Bluetooth on Android 10 due to a missing bounds check. Exploitation could lead to remote DoS without user interaction. Affected product/variant: Android 10 (Android ID: A-111215315). Public metrics: CVSSv3.1 base score 7.5 (High) with network attac...

CVE-2019-9305

CVE-2019-9305 affects libAACdec in Android 10 (Android-10). The root cause is an integer overflow causing an out-of-bounds write, enabling remote code execution. Exploitation requires user interaction; no additional privileges are needed beyond the targeted device. Documented under Android 10 rel...

CVE-2019-9353

CVE-2019-9353 affects Android 10 Bluetooth stack; root cause is a missing bounds check causing an out-of-bounds read, enabling potential information disclosure. NVD notes user interaction not required for exploitation in some vectors and network-based access; ZDI-19-640 details a Bluetooth heap-b...

CVE-2019-9381

CVE-2019-9381 affects Android’s netd, with an out-of-bounds read caused by a use-after-free. This leads to remote information disclosure without additional privileges or user interaction on Android 10. The available documents confirm the vulnerable component and the impact but do not provide expl...

CVE-2019-9384

CVE-2019-9384 affects Android 10 in the framework component LockPatternUtils. The issue is an improper permissions check that enables elevation of privilege by bypassing the Lockguard, granting System-level execution privileges without user interaction. The CVE entry notes local exploitation is p...

CVE-2019-9391

CVE-2019-9391 is a vulnerability in the Android 10 libxaac library where an out-of-bounds read can occur due to uninitialized data, leading to information disclosure. The issue affects Android-10 (Android 10) and requires user interaction to exploit. The available sources in the provided document...

CVE-2020-0038

CVE-2020-0038 affects Android devices (Android 8.0–10) due to a missing bounds check in rw_i93_sm_update_ndef of rw_i93.cc , which can cause a read of uninitialized data and lead to remote information disclosure without additional execution privileges or user interaction. The available documents ...

CVE-2020-0086

CVE-2020-0086 affects Android 10. In Parcel.cpp, readCString may perform an out-of-bounds write due to an integer overflow, potentially enabling arbitrary code execution if IntSan is not enabled (it is by default). The vulnerability requires no user interaction and can be exploited remotely over ...

CVE-2020-0132

CVE-2020-0132 affects Android 10 via BnAAudioService::onTransact in IAAudioService.cpp, where unsafe deserialization can trigger an out-of-bounds read. The underlying bug permits local information disclosure without extra privileges or user interaction. Publicly documented references in the Pixel...

CVE-2020-0146

CVE-2020-0146 affects Android 10 in the btu_hcif hardware path (btu_hcif.cc). The issue is a missing bounds check that enables an out-of-bounds read, potentially allowing local information disclosure with system privileges. No user interaction is required. The Red Hat and NVD entries corroborate ...

CVE-2020-0151

CVE-2020-0151 affects Android 10 and is triggered in the avb_vbmeta_image_verify function of avb_vbmeta_image.c. The flaw is an out-of-bounds read due to a missing bounds check, leading to possible local information disclosure with system privileges (no user interaction required). Public details ...