CVE-2018-9453

CVE-2018-9453 describes a local information-disclosure vulnerability in Android where, in avdt_msg_prs_cfg of avdt_msg.cc, a missing bounds check allows an out-of-bounds read. Affects Android versions 6.0–8.1 (including 6.0.0/6.0.1, 7.0, 7.1.x, 8.0, 8.1). The underlying issue is a missing bounds ...

CVE-2018-9503

The CVE-2018-9503 entry describes an out-of-bounds read in rfc_process_mx_message() within rfc_ts_frames.cc, leading to remote information disclosure without requiring privileges or user interaction. Affected software includes Android versions 7.0 through 9.0. The vulnerability’s root cause is a ...

CVE-2018-9521

CVE-2018-9521 describes an out-of-bounds write in NuPlayer2CCDecoder.cpp (parseMPEGCCData) on Android 9, enabling remote code execution in an unprivileged process with user interaction. The issue arises from an incorrect bounds check in the Media framework’s MPEG data handling, potentially allowi...

CVE-2018-9525

CVE-2018-9525 affects Android 9 Framework: an elevation of privilege via a permissions bypass in the AndroidManifest.xml SliceBroadcastReceiver for com.android.settings.slice.action.WIFI_CHANGED. This could allow a local attacker to change device settings with no additional privileges and no user...

CVE-2018-9529

CVE-2018-9529 affects Android 9 and is triggered by an out-of-bounds write in ixheaacd_individual_ch_stream within ixheaacd_channel.c caused by a missing bounds check. The issue could allow remote code execution with no privileges, with user interaction required for exploitation. No exploitation ...

CVE-2018-9540

The CVE-2018-9540 issue affects Android’s Bluetooth stack. In avrc_ctrl_pars_vendor_rsp (avrc_pars_ct.c) a missing bounds check allows an out-of-bounds read, enabling remote information disclosure over Bluetooth without user interaction or added privileges. Affected: Android 7.0–9 (Android-7.0, 7...

CVE-2018-9542

CVE-2018-9542 concerns Android’s avrc_pars_vendor_rsp in avrc_pars_ct.cc, where a missing bounds check allows an out-of-bounds read. This could lead to remote information disclosure without extra execution privileges; no user interaction is required. Affected products/versions include Android 7.0...

CVE-2018-9553

CVE-2018-9553 : In MasteringMetadata::Parse of mkvparser.cc, a double-free can occur due to an insecure default value, enabling remote code execution. Affected: Android devices/versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9. Exploitation requires user interaction (local attack). Evidence ties this CVE ...

CVE-2018-9575

CVE-2018-9575 affects Android 9, with a vulnerability in impd_parse_dwnmix_instructions in impd_drc_static_payload.c. The root cause is a missing bounds check, causing an out-of-bounds write that could enable remote code execution. Exploitation is described as requiring user interaction, and the ...

CVE-2018-9582

CVE-2018-9582 affects Android 8.0–9 package installer, enabling local elevation of privilege via bypassing the unknown-source warning in a confused deputy scenario. Exploitation requires no user interaction; attacker gains partial to high impact on confidentiality, integrity, and availability. Th...

CVE-2019-2040

CVE-2019-2040 affects Android 9 (rw_i93_process_ext_sys_info in rw_i93.cc). It is caused by a missing bounds check, leading to a possible out-of-bounds read and local information disclosure; exploitation requires user interaction. The Android Security Bulletin assigns this vulnerability to the Sy...

CVE-2019-2052

CVE-2019-2052 : In VisitPointers of heap.cc, Android’s System component, there is a potential out-of-bounds read caused by type confusion. This could enable remote information disclosure without extra execution privileges or user interaction. Affected Android versions include 7.0, 7.1.1, 7.1.2, 8...

CVE-2019-20531

CVE-2019-20531 affects Samsung mobile devices running Android P (9.0) on Exynos chipsets, with a vulnerability in the Wi‑Fi kernel drivers that permits an out-of-bounds read. Related Samsung identifiers: SVE-2019-15692, SVE-2019-15693. CVSS data indicate a High impact on confidentiality and avail...

CVE-2019-20537

CVE-2019-20537 affects Samsung mobile devices on P(9.0) platforms leveraging the SEM Trustlet (TEEGRIS/Qualcomm chipsets). The vulnerability is an arbitrary memory overwrite in the SEM Trustlet, which can lead to arbitrary code execution. Affected hardware/firmware details: Samsung devices using ...

CVE-2019-20541

The CVE-2019-20541 entry concerns Samsung mobile devices running Android P (9.0) on Exynos chipsets, where the Wi-Fi kernel drivers are affected by a stack overflow. Affected Samsung IDs include SVE-2019-14965, 14966, 14968–14970, 14980–14984, 15122–15123 (November 2019). The issue originates in ...

CVE-2019-20549

The vulnerability CVE-2019-20549 affects Samsung mobile devices (N7.x, O8.x, P9.0) with Broadcom Bluetooth, where a heap out-of-bounds access can occur during LE Packet reception. The issue is tracked under Samsung ID SVE-2019-15724. According to the provided metrics, the CVSS base scores indicat...

CVE-2019-20560

CVE-2019-20560 affects Samsung mobile devices on O(8.x) and P(9.0) with TEEGRIS. The BIOSUB Trustlet has an out-of-bounds write vulnerability. Connected sources (Red Hat, NVD/NVD list) confirm the issue description but do not provide affected product versions beyond the Samsung device/software fa...

CVE-2019-20567

The CVE-2019-20567 issue affects Samsung mobile devices running N(7.x), O(8.x), and P(9.0) on Exynos chipsets. The root cause is a heap overflow in up_parm, which leads to code execution in the bootloader. Documented impact is high/severe (bootloader code execution possible). Exploitation details...

CVE-2019-20579

Samsung reports a vulnerability in the Gallery app on Galaxy devices running N(7.x), O(8.x), and P(9.0) that allows attackers to enable location information sharing from the lock screen. The entry references Samsung ID SVE-2019-14462 (August 2019). No concrete exploit details, affected specific m...

CVE-2019-20591

CVE-2019-20591 affects Samsung mobile devices running N (7.x), O (8.x), and P (9.0) with a local SQL injection in the Gear VR Service Content Provider. The issue, tracked as Samsung Samsung ID SVE-2019-14058, is documented across multiple feeds (NVD, Red Hat, etc.). The connected sources confirm ...

CVE-2019-20592

CVE-2019-20592 affects Samsung mobile devices running N(7.x), O(8.x) and P(9.0). The issue is a local SQL injection in the Story Video Editor Content Provider, with Samsung ID SVE-2019-14062. Connected documents corroborate this vulnerability and do not provide concrete patch versions or remediat...

CVE-2019-20595

CVE-2019-20595 concerns Samsung mobile devices running P(9.0) where the Quick Panel can enable or disable the Bluetooth stack without authentication. Affected: Samsung mobile devices with P(9.0) software (as cited in the CVE records). Root cause: an insecure Quick Panel action allows state change...

CVE-2019-20606

CVE-2019-20606 affects Samsung mobile devices with software prior to May 2019. A phishing attack against the OMACP service can change network and internet settings (Samsung ID SVE-2019-14073). The NVD entries show CVSSv3.1 base score 9.3 (NETWORK, UI REQUIRED, I:H, A:H) and CVSSv2.0 base 5.8 (I:P...

CVE-2019-20616

Technical details (affected component, root cause, version-specific impact, or fixes) are not publicly provided in the connected documents. Monitor for updates from Samsung and security advisories.

CVE-2019-20621

CVE-2019-20621 concerns a baseband heap overflow in Samsung mobile devices with Exynos baseband software (N(7.x), O(8.x), P(9.0)). Multiple feeds (Red Hat, CNVD, CVE lists, CVEs) reference the same issue; Samsung’s internal ID is SVE-2018-13187 (Feb 2019). The NVD entry cites a critical CVSS-3.1 ...

CVE-2019-20773

CVE-2019-20773 affects LG mobile devices running Android OS 7.x–9.0; the issue allows unprivileged applications to execute shell commands via the connectivity service. Root cause is not detailed in the provided documents; no exploit specifics or remediation are described in the connected sources....

CVE-2019-2089

CVE-2019-2089 affects Android 10 Framework: during app uninstallation, a set of permissions may remain for a shared app ID, enabling local privilege escalation with no additional execution privileges required. The condition is exploitable with user interaction. The issue is documented in Android ...

CVE-2019-2203

CVE-2019-2203 is a local elevation-of-privilege in Android’s CryptoPlugin.decrypt due to a heap-buffer overflow causing an out-of-bounds write. Affected: Android 8.0–10. Impact: local privilege escalation with no user interaction (per CVE description). The Red Hat and NVD records corroborate the ...

CVE-2019-9249

CVE-2019-9249 refers to a Bluetooth vulnerability in Android 10 where an out-of-bounds read could lead to local information disclosure without privileges or user interaction. The issue arises from a missing bounds check in Bluetooth handling. Impact per sources: potential exposure of partial info...

CVE-2019-9260

CVE-2019-9260 affects Android 10 and is a Bluetooth information-disclosure vulnerability caused by an out-of-bounds read from an incorrect bounds check. Exploitation is possible remotely over a network with no user interaction, potentially leading to partial confidentiality loss. NVD metrics show...

CVE-2019-9294

CVE-2019-9294 affects the Android 10 libstagefright component, describing an out-of-bounds read due to a missing bounds check. This vulnerability can lead to remote information disclosure with user interaction required for exploitation; no explicit in-the-wild exploit details are provided in the ...

CVE-2019-9360

CVE-2019-9360 affects Android 10 on the TEE, with an out-of-bounds read caused by a missing bounds check. This could enable local information disclosure with system-level privileges, without user interaction. Exploitation details are not provided in the documents; mitigations/patches are referenc...

CVE-2020-0029

CVE-2020-0029 affects Android 10 WifiConfigManager by allowing storage of location history that can only be erased via a factory reset. The issue enables local information disclosure with System-level privileges and requires no user interaction. The vulnerability is tied to the WifiConfigManager c...

CVE-2020-0089

CVE-2020-0089 is a localElevation of privilege issue in Android 11, caused by a missing permission check in the audio server. The vulnerability allows escalation of privileges to modify audio settings without extra execution privileges or user interaction. Affected software/module: Android 11 aud...

CVE-2020-0125

CVE-2020-0125 affects Android 11 media framework (mediadrm). The issue is a missing bounds check causing an out-of-bounds read that can disclose local information without extra privileges and without user interaction. Multiple sources corroborate this, listing mediadrm as the vulnerable component...

CVE-2020-0127

CVE-2020-0127 affects Android 10 via the Media/Audio framework: an out-of-bounds read in AudioStream::decode (AudioGroup.cpp) caused by a missing bounds check. This can lead to information disclosure in the phone process without extra execution privileges; exploitation reportedly requires user in...

CVE-2020-0134

The CVE-2020-0134 entry concerns Android 10 where in BnDrm::onTransact of IDrm.cpp there is information disclosure due to uninitialized data. This can lead to local information disclosure without extra privileges and without user interaction. Public references include NVD and Red Hat advisories, ...

CVE-2020-0163

CVE-2020-0163 targets MPEG4Extractor.cpp (parseSampleAuxiliaryInformationSizes) and can cause resource exhaustion leading to remote DoS on Android 10. Documents confirm a vulnerability in the Android Media Framework with input validation weaknesses; CVSS2/3 metrics indicate network access with no...

CVE-2020-0188

The CVE-2020-0188 entry concerns Android 10 and a vulnerability in SettingsSliceProvider.java. In onCreatePermissionRequest, a PendingIntent error can permit a permissions bypass, enabling local elevation of privilege with user privileges required and no user interaction needed. Public disclosure...

CVE-2020-0196

CVE-2020-0196 affects Android 10 in the Bluetooth stack. In RegisterNotificationResponse::GetEvent, improper input validation can cause an abort, resulting in remote denial of service over Bluetooth with no extra privileges and no user interaction required. This is described in Android Pixel secu...

CVE-2020-0205

Technical details for CVE-2020-0205 are not publicly available in the provided documents. Monitor for updates.

CVE-2020-0209

CVE-2020-0209 affects Android 10 Framework (AccountManager.java). Description: permissions bypass in multiple AccountManager functions could enable local elevation of privilege without additional execution privileges required; exploitation requires no user interaction. Evidence across documents s...

CVE-2020-0210

CVE-2020-0210 affects Android 10 Framework code (removeSharedAccountAsUser in AccountManager.java), enabling a local elevation of privilege due to a permissions bypass (confused deputy). Exploitation requires no user interaction; local access suffices. The Pixel security bulletin lists this issue...

CVE-2020-0216

Technical details about CVE-2020-0216 are not publicly provided in the supplied documents. Monitor for updates.

CVE-2020-0223

CVE-2020-0223 is an Android kernel vulnerability (kernel audio component) described as an unbounded write into kernel global memory via a user-controlled buffer size. Affects Android kernel with Audio subcomponent; root cause is uncontrolled buffer handling that can lead to elevation of privilege...

CVE-2020-0290

CVE-2020-0290 affects Android 11's PackageManager and stems from a missing permission check, enabling local information disclosure across users with no extra privileges and no user interaction. Exploitation details are not provided in the connected documents beyond the description. Remediation: a...

CVE-2020-0312

CVE-2020-0312 affects Android 11 Battery Saver. It describes a permission bypass caused by an unsafe PendingIntent that could disclose local information; exploitation details are not provided, and no in-the-wild status is stated. The vulnerability is mitigated by Android 11 security updates (patc...

CVE-2020-0325

CVE-2020-0325 affects Android 11 with a vulnerability in the NFC subsystem where a missing bounds check can lead to local information disclosure and potential system execution privileges. The issue is triggered without user interaction and is exploitable with local access; impact is limited to in...

CVE-2020-0343

CVE-2020-0343 affects Android 11, specifically the NetworkStatsService. Root cause: a missing permission check allows access to protected data, enabling local information disclosure with no extra execution privileges. Exploitation prerequisites: none (user interaction not required). Impact (as st...

CVE-2020-0483

CVE-2020-0483 affects DrmManagerService in Android-11. The issue is a memory corruption via a use-after-free in the DrmManagerService destructor (DrmManagerService.cpp), enabling local elevation of privilege with System execution privileges required. User interaction is not needed. The descriptio...