CVE-2019-2040

CVE-2019-2040 affects Android 9 (rw_i93_process_ext_sys_info in rw_i93.cc). It is caused by a missing bounds check, leading to a possible out-of-bounds read and local information disclosure; exploitation requires user interaction. The Android Security Bulletin assigns this vulnerability to the Sy...

CVE-2019-2052

CVE-2019-2052 : In VisitPointers of heap.cc, Android’s System component, there is a potential out-of-bounds read caused by type confusion. This could enable remote information disclosure without extra execution privileges or user interaction. Affected Android versions include 7.0, 7.1.1, 7.1.2, 8...

CVE-2019-20531

CVE-2019-20531 affects Samsung mobile devices running Android P (9.0) on Exynos chipsets, with a vulnerability in the Wi‑Fi kernel drivers that permits an out-of-bounds read. Related Samsung identifiers: SVE-2019-15692, SVE-2019-15693. CVSS data indicate a High impact on confidentiality and avail...

CVE-2019-20537

CVE-2019-20537 affects Samsung mobile devices on P(9.0) platforms leveraging the SEM Trustlet (TEEGRIS/Qualcomm chipsets). The vulnerability is an arbitrary memory overwrite in the SEM Trustlet, which can lead to arbitrary code execution. Affected hardware/firmware details: Samsung devices using ...

CVE-2019-20541

The CVE-2019-20541 entry concerns Samsung mobile devices running Android P (9.0) on Exynos chipsets, where the Wi-Fi kernel drivers are affected by a stack overflow. Affected Samsung IDs include SVE-2019-14965, 14966, 14968–14970, 14980–14984, 15122–15123 (November 2019). The issue originates in ...

CVE-2019-20549

The vulnerability CVE-2019-20549 affects Samsung mobile devices (N7.x, O8.x, P9.0) with Broadcom Bluetooth, where a heap out-of-bounds access can occur during LE Packet reception. The issue is tracked under Samsung ID SVE-2019-15724. According to the provided metrics, the CVSS base scores indicat...

CVE-2019-20560

CVE-2019-20560 affects Samsung mobile devices on O(8.x) and P(9.0) with TEEGRIS. The BIOSUB Trustlet has an out-of-bounds write vulnerability. Connected sources (Red Hat, NVD/NVD list) confirm the issue description but do not provide affected product versions beyond the Samsung device/software fa...

CVE-2019-20567

The CVE-2019-20567 issue affects Samsung mobile devices running N(7.x), O(8.x), and P(9.0) on Exynos chipsets. The root cause is a heap overflow in up_parm, which leads to code execution in the bootloader. Documented impact is high/severe (bootloader code execution possible). Exploitation details...

CVE-2019-20579

Samsung reports a vulnerability in the Gallery app on Galaxy devices running N(7.x), O(8.x), and P(9.0) that allows attackers to enable location information sharing from the lock screen. The entry references Samsung ID SVE-2019-14462 (August 2019). No concrete exploit details, affected specific m...

CVE-2019-20591

CVE-2019-20591 affects Samsung mobile devices running N (7.x), O (8.x), and P (9.0) with a local SQL injection in the Gear VR Service Content Provider. The issue, tracked as Samsung Samsung ID SVE-2019-14058, is documented across multiple feeds (NVD, Red Hat, etc.). The connected sources confirm ...

CVE-2019-20592

CVE-2019-20592 affects Samsung mobile devices running N(7.x), O(8.x) and P(9.0). The issue is a local SQL injection in the Story Video Editor Content Provider, with Samsung ID SVE-2019-14062. Connected documents corroborate this vulnerability and do not provide concrete patch versions or remediat...

CVE-2019-20595

CVE-2019-20595 concerns Samsung mobile devices running P(9.0) where the Quick Panel can enable or disable the Bluetooth stack without authentication. Affected: Samsung mobile devices with P(9.0) software (as cited in the CVE records). Root cause: an insecure Quick Panel action allows state change...

CVE-2019-20606

CVE-2019-20606 affects Samsung mobile devices with software prior to May 2019. A phishing attack against the OMACP service can change network and internet settings (Samsung ID SVE-2019-14073). The NVD entries show CVSSv3.1 base score 9.3 (NETWORK, UI REQUIRED, I:H, A:H) and CVSSv2.0 base 5.8 (I:P...

CVE-2019-20616

Technical details (affected component, root cause, version-specific impact, or fixes) are not publicly provided in the connected documents. Monitor for updates from Samsung and security advisories.

CVE-2019-20621

CVE-2019-20621 concerns a baseband heap overflow in Samsung mobile devices with Exynos baseband software (N(7.x), O(8.x), P(9.0)). Multiple feeds (Red Hat, CNVD, CVE lists, CVEs) reference the same issue; Samsung’s internal ID is SVE-2018-13187 (Feb 2019). The NVD entry cites a critical CVSS-3.1 ...

CVE-2019-20773

CVE-2019-20773 affects LG mobile devices running Android OS 7.x–9.0; the issue allows unprivileged applications to execute shell commands via the connectivity service. Root cause is not detailed in the provided documents; no exploit specifics or remediation are described in the connected sources....

CVE-2019-2089

CVE-2019-2089 affects Android 10 Framework: during app uninstallation, a set of permissions may remain for a shared app ID, enabling local privilege escalation with no additional execution privileges required. The condition is exploitable with user interaction. The issue is documented in Android ...

CVE-2019-2203

CVE-2019-2203 is a local elevation-of-privilege in Android’s CryptoPlugin.decrypt due to a heap-buffer overflow causing an out-of-bounds write. Affected: Android 8.0–10. Impact: local privilege escalation with no user interaction (per CVE description). The Red Hat and NVD records corroborate the ...

CVE-2019-9249

CVE-2019-9249 refers to a Bluetooth vulnerability in Android 10 where an out-of-bounds read could lead to local information disclosure without privileges or user interaction. The issue arises from a missing bounds check in Bluetooth handling. Impact per sources: potential exposure of partial info...

CVE-2019-9260

CVE-2019-9260 affects Android 10 and is a Bluetooth information-disclosure vulnerability caused by an out-of-bounds read from an incorrect bounds check. Exploitation is possible remotely over a network with no user interaction, potentially leading to partial confidentiality loss. NVD metrics show...

CVE-2019-9294

CVE-2019-9294 affects the Android 10 libstagefright component, describing an out-of-bounds read due to a missing bounds check. This vulnerability can lead to remote information disclosure with user interaction required for exploitation; no explicit in-the-wild exploit details are provided in the ...

CVE-2019-9360

CVE-2019-9360 affects Android 10 on the TEE, with an out-of-bounds read caused by a missing bounds check. This could enable local information disclosure with system-level privileges, without user interaction. Exploitation details are not provided in the documents; mitigations/patches are referenc...

CVE-2020-0029

CVE-2020-0029 affects Android 10 WifiConfigManager by allowing storage of location history that can only be erased via a factory reset. The issue enables local information disclosure with System-level privileges and requires no user interaction. The vulnerability is tied to the WifiConfigManager c...

CVE-2020-0089

CVE-2020-0089 is a localElevation of privilege issue in Android 11, caused by a missing permission check in the audio server. The vulnerability allows escalation of privileges to modify audio settings without extra execution privileges or user interaction. Affected software/module: Android 11 aud...

CVE-2020-0125

CVE-2020-0125 affects Android 11 media framework (mediadrm). The issue is a missing bounds check causing an out-of-bounds read that can disclose local information without extra privileges and without user interaction. Multiple sources corroborate this, listing mediadrm as the vulnerable component...

CVE-2020-0127

CVE-2020-0127 affects Android 10 via the Media/Audio framework: an out-of-bounds read in AudioStream::decode (AudioGroup.cpp) caused by a missing bounds check. This can lead to information disclosure in the phone process without extra execution privileges; exploitation reportedly requires user in...

CVE-2020-0134

The CVE-2020-0134 entry concerns Android 10 where in BnDrm::onTransact of IDrm.cpp there is information disclosure due to uninitialized data. This can lead to local information disclosure without extra privileges and without user interaction. Public references include NVD and Red Hat advisories, ...

CVE-2020-0163

CVE-2020-0163 targets MPEG4Extractor.cpp (parseSampleAuxiliaryInformationSizes) and can cause resource exhaustion leading to remote DoS on Android 10. Documents confirm a vulnerability in the Android Media Framework with input validation weaknesses; CVSS2/3 metrics indicate network access with no...

CVE-2020-0188

The CVE-2020-0188 entry concerns Android 10 and a vulnerability in SettingsSliceProvider.java. In onCreatePermissionRequest, a PendingIntent error can permit a permissions bypass, enabling local elevation of privilege with user privileges required and no user interaction needed. Public disclosure...

CVE-2020-0196

CVE-2020-0196 affects Android 10 in the Bluetooth stack. In RegisterNotificationResponse::GetEvent, improper input validation can cause an abort, resulting in remote denial of service over Bluetooth with no extra privileges and no user interaction required. This is described in Android Pixel secu...

CVE-2020-0205

Technical details for CVE-2020-0205 are not publicly available in the provided documents. Monitor for updates.

CVE-2020-0209

CVE-2020-0209 affects Android 10 Framework (AccountManager.java). Description: permissions bypass in multiple AccountManager functions could enable local elevation of privilege without additional execution privileges required; exploitation requires no user interaction. Evidence across documents s...

CVE-2020-0210

CVE-2020-0210 affects Android 10 Framework code (removeSharedAccountAsUser in AccountManager.java), enabling a local elevation of privilege due to a permissions bypass (confused deputy). Exploitation requires no user interaction; local access suffices. The Pixel security bulletin lists this issue...

CVE-2020-0216

Technical details about CVE-2020-0216 are not publicly provided in the supplied documents. Monitor for updates.

CVE-2020-0223

CVE-2020-0223 is an Android kernel vulnerability (kernel audio component) described as an unbounded write into kernel global memory via a user-controlled buffer size. Affects Android kernel with Audio subcomponent; root cause is uncontrolled buffer handling that can lead to elevation of privilege...

CVE-2020-0290

CVE-2020-0290 affects Android 11's PackageManager and stems from a missing permission check, enabling local information disclosure across users with no extra privileges and no user interaction. Exploitation details are not provided in the connected documents beyond the description. Remediation: a...

CVE-2020-0312

CVE-2020-0312 affects Android 11 Battery Saver. It describes a permission bypass caused by an unsafe PendingIntent that could disclose local information; exploitation details are not provided, and no in-the-wild status is stated. The vulnerability is mitigated by Android 11 security updates (patc...

CVE-2020-0325

CVE-2020-0325 affects Android 11 with a vulnerability in the NFC subsystem where a missing bounds check can lead to local information disclosure and potential system execution privileges. The issue is triggered without user interaction and is exploitable with local access; impact is limited to in...

CVE-2020-0343

CVE-2020-0343 affects Android 11, specifically the NetworkStatsService. Root cause: a missing permission check allows access to protected data, enabling local information disclosure with no extra execution privileges. Exploitation prerequisites: none (user interaction not required). Impact (as st...

CVE-2020-0483

CVE-2020-0483 affects DrmManagerService in Android-11. The issue is a memory corruption via a use-after-free in the DrmManagerService destructor (DrmManagerService.cpp), enabling local elevation of privilege with System execution privileges required. User interaction is not needed. The descriptio...

CVE-2020-0485

CVE-2020-0485 affects Android 11. In UsbBackend.java’s areFunctionsSupported, a missing permission check can allow tethering access from a guest account, enabling local elevation of privilege with no user interaction. According to NVD, the CVSSv3.1 vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I...

CVE-2020-0498

CVE-2020-0498 affects Android 11 and is associated with a heap buffer overflow in decode_packed_entry_number inside codebook.c, causing an out-of-bounds read that can disclose information remotely with no memory integrity impact and requires user interaction to exploit. Public records consistentl...

CVE-2020-10843

Affected products: Samsung mobile devices running O(8.x), P(9.0), and Q(10.0) on S.LSI chipsets. Issue: race conditions in the hdcp2 driver. Root cause details are limited to the presence of race conditions in the hdcp2 driver as described in multiple sources. Samsung internal ID: SVE-2019-16296 ...

CVE-2020-11602

Technical details about CVE-2020-11602 are not publicly available in the provided documents. Monitor for updates from NVD/Red Hat/CVE sources as more information may be released.

CVE-2020-11603

CVE-2020-11603 affects Samsung mobile devices running P(9.0) and Q(10.0) that include TEEGRIS. The issue is a type confusion in the MLDAP Trustlet, leading to arbitrary code execution. The vulnerability is identified by Samsung as SVE-2020-16599 (April 2020). Exploitation details, affected versio...

CVE-2020-11874

CVE-2020-11874 concerns LG mobile devices running Android 8.x–10, where attackers can bypass Factory Reset Protection (FRP). The LG internal ID is LVE-SMP-200004 (March 2020). Connected sources (NVD, Red Hat advisory, CVE listings) corroborate the FRP bypass claim. The documents do not provide co...

CVE-2020-15582

Summary of CVE-2020-15582 : A BLE buffer overflow issue was reported on Samsung mobile devices running P (9.0) and Q (10.0) on Exynos 7885, leading to a deadlock or crash in the Bluetooth Low Energy component. The Samsung internal ID is SVE-2020-16870 (July 2020). Connected documents confirm the ...

CVE-2020-15584

CVE-2020-15584 affects Samsung mobile devices running Q(10.0). The issue arises when processing a 4K wallpaper image, where ImageProcessHelper mishandles boundary checks, causing out-of-bounds access that can lead to a device reset. Samsung’s internal ID for this vulnerability is SVE-2020-18056 (...

CVE-2020-25051

CVE-2020-25051 affects Samsung mobile devices running Android P (9.0) and Q (10.0). The vulnerability permits bypassing Factory Reset Protection (FRP) via AppInfo, as described across multiple sources (NVD entry, Red Hat advisory, NCSC summary) with Samsung’s ID SVE-2020-17758. The exact affected...

CVE-2020-25065

CVE-2020-25065 affects LG mobile devices running Android 4.4–10. The issue is that an obsolete API enables key logging, leading to potential confidentiality impact (C:H) with no integrity/availability impact. Root cause described as use of an obsolete API; CVSS:3.1 base score 7.5 (Network attack ...