CVE-2020-27032

In CVE-2020-27032, a missing permission check in getRadioAccessFamily() of PhoneInterfaceManager.java allows a local attacker to read privileged radio data on Android-11, potentially leading to information disclosure without user interaction. Affected component is the Android framework (PhoneInte...

CVE-2020-27035

CVE-2020-27035 : In Android’s media stack, specifically in priorLinearAllocation() of C2AllocatorIon.cpp, there is a possible use-after-free caused by improper locking. This can lead to local information disclosure in the media codec without additional execution privileges. Affected: Android-11. ...

CVE-2020-27038

CVE-2020-27038 affects Android 11 with a memory-leak in C2SoftVorbisDec.cpp that can exhaust memory and cause remote denial of service. Exploitation requires user interaction; no explicit exploit details are provided in the connected documents. The available sources confirm the DoS impact and the...

CVE-2020-27046

CVE-2020-27046 affects Android 11 (per initial description). The issue is in nfc_ncif_proc_ee_action of nfc_ncif.cc, where a missing bounds check allows an out-of-bounds read that can lead to local information disclosure with system-level privileges. Exploitation requires no user interaction. NVD...

CVE-2020-27097

CVE-2020-27097 affects Android 11. The vulnerability exists in UriGrantsManagerService.java (checkGrantUriPermission), enabling a local information disclosure without additional exploitation privileges or user interaction. Concrete impact documented as a permissions bypass that could expose parti...

CVE-2020-35553

CVE-2020-35553 affects Samsung mobile devices running Android Q (10.0) and R (11.0) on Qualcomm SM8250 chipsets. The issue allows a denial of service (unlock failure) by triggering a power-shortage incident that leads to a false-positive attack detection. No concrete exploit details, affected sof...

CVE-2021-0361

Technical details about CVE-2021-0361 are not publicly available in the provided connected documents. Monitor for updates; current sources reiterate the same vulnerable description without additional specifics.

CVE-2021-0363

CVE-2021-0363 affects Android (Android-10 and Android-11) with vulnerability in the mobile_log_d component, caused by a missing bounds check that enables command injection and local escalation of privilege to SYSTEM without user interaction. The issue is documented in multiple sources (e.g., Andr...

CVE-2021-0376

CVE-2021-0376 affects Android 11 via MediaProvider.java (checkUriPermission) with a permissions bypass that enables local escalation of privilege without extra execution privileges. The vulnerability is described as an Elevation of Privilege (EoP) issue; affected component is Media framework/Andr...

CVE-2021-0385

CVE-2021-0385 affects Android 11, specifically the ConnectToNetworkNotificationBuilder.java path (createConnectToAvailableNetworkNotification). The issue allows a local elevation of privilege via connection to untrusted Wi‑Fi networks triggered by notification interaction above the lockscreen, wi...

CVE-2021-0389

CVE-2021-0389 affects Android 11; root cause is a missing permission check in UiModeManagerService.setNightModeActivated (UiModeManagerService.java). This permits local privilege escalation without additional execution privileges and without user interaction. Public information confirms the issue...

CVE-2021-0616

CVE-2021-0616 affects the MediaTek ape extractor. The issue is a heap buffer overflow causing an out-of-bounds read, leading to local information disclosure without extra privileges or user interaction. Affected component is the ape extractor (buffer handling) and the documents consistently descr...

CVE-2021-0621

In the asf extractor component, CVE-2021-0621 describes a possible out-of-bounds read caused by an integer overflow. This could lead to local information disclosure without requiring user interaction or additional execution privileges. A patch is available (ALPS05489178; ALPS05561383). The issue ...

CVE-2021-0670

The CVE-2021-0670 entry concerns an issue in the apusys component where a use-after-free can cause memory corruption, enabling local escalation of privilege with SYSTEM execution privileges; exploitation reportedly does not require user interaction. Patch ID ALPS05654663 (Issue ID ALPS05654663) i...

CVE-2021-0896

CVE-2021-0896 affects the MediaTek Apusys component (apusys): a missing bounds check allows an out-of-bounds write, enabling local escalation of privilege with System execution privileges. User interaction is not required. The issue is documented across NVD and Red Hat entries; the cited patch is...

CVE-2021-0899

In CVE-2021-0899, the apusys component in MediaTek exhibits a memory corruption issue caused by a use-after-free, enabling local escalation of privilege with System execution privileges required. No user interaction is needed for exploitation. Affected details and mitigation: Patch ID ALPS0567210...

CVE-2021-25390

CVE-2021-25390 corresponds to an intent redirection vulnerability in Samsung’s PhotoTable within the SMR MAY-2021 Release 1. Affected component/file: PhotoTable (Samsung’s software update stack). Root cause and impact, as documented: it enables an attacker with local access to perform a privilege...

CVE-2021-25408

CVE-2021-25408 concerns a buffer overflow in the NPU driver prior to Samsung SMR JUN-2021 Release 1. The underlying issue is a memory overwrite vulnerability in the driver that could lead to arbitrary memory write and code execution. Affected product scope is the NPU driver as described; no speci...

CVE-2021-25469

The vulnerability CVE-2021-25469 affects Widevine trustlet prior to Samsung SMR Oct-2021 Release 1. It is a stack-based buffer overflow in the trustlet that can lead to arbitrary code execution with local access and low attack complexity. Impact is partial to high confidentiality/integrity/availa...

CVE-2021-25481

The CVE-2021-25481 entry concerns Samsung Exynos CPU (Exynos CP) booting driver. It reports improper error handling that allows local attackers to bypass the Secure Memory Protector of Exynos CP Memory prior to SMR Oct-2021 Release 1. Public references in the provided documents corroborate the ex...

CVE-2021-25482

CVE-2021-25482 refers to a SQL injection vulnerability in the CMFA framework, prior to Samsung SMR Oct-2021 Release 1. According to connected sources (NVD, Red Hat, CVE listings, PRION, CNNVD, and others), the issue allows an untrusted application to overwrite some CMFA framework information. The...

CVE-2021-25514

Technical details about CVE-2021-25514 are not publicly available in the provided connected documents. Monitor for updates from official advisories.

CVE-2021-25517

CVE-2021-25517 affects Samsung LDFW firmware prior to SMR Dec-2021 Release 1. The vulnerability arises from improper input validation in LDFW, enabling arbitrary code execution on affected devices. Documented impact includes remote/local (depending on context) execution with high severity (CVSS v...

CVE-2021-25518

CVE-2021-25518 affects Samsung LDFW and BL31. The issue is an improper boundary check in the secure_log before SMR Dec-2021 Release 1, enabling arbitrary memory write and code execution. Reported impact includes local access with partial confidentiality/integrity/availability implications as per ...

CVE-2022-36841

Affected software: libSDKRecognitionText.spensdk.samsung.so on Samsung devices. Vulnerability: heap-based overflow in PrepareRecogLibrary_Part function prior to SMR Sep-2022 Release 1, causing memory access fault. Exploitability/impact: CVE reports local access with memory impact; no explicit exp...

CVE-2022-36856

The CVE-2022-36856 entry concerns Samsung Telecom application on mobile devices. Affected component: Telecom application prior to SMR Sep-2022 Release 1. Root cause: improper access control that allowed an attacker to start emergency calls via undefined permission. Impact: demonstrated capability...

CVE-2022-47478

Affected software: telephony service. Root cause: missing permission check leading to potential local information disclosure. Impact: local information disclosure without additional execution privileges; confidentiality impact HIGH, as per CVE entry. Exploitation status: not described in the prov...

CVE-2022-47489

CVE-2022-47489 affects UNISOC chipsets’ soter service module, where a missing bounds check can trigger an out-of-bounds write. This flaw may allow local denial of service with System execution privileges required. Documents in connected sources corroborate the issue as a boundary-check deficiency...

CVE-2022-48236

CVE-2022-48236 concerns the MP3 encoder in UNISOC chipsets. A missing bounds check can cause an out-of-bounds read, leading to local denial of service with system‑level privileges required. Reported base metrics (CVSS 3.1: AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H; base score 4.4) indicate local access...

CVE-2022-48386

The CVE-2022-48386 entry concerns the apipe driver with a use-after-free caused by a logic error, leading to local denial of service with SYSTEM privileges. This is documented across multiple feeds (NVD, Red Hat, CVE List) and references UNISOC chipsets’ apipe driver. No explicit patch/version re...

CVE-2022-48448

CVE-2022-48448 affects the telephony service and is associated with a missing permission check that could allow a local denial of service without elevating privileges. Across the provided sources (NVD, RH, CVE list, PRION, CNNVD, etc.), the core described impact is local DoS with no additional ex...

CVE-2023-20684

CVE-2023-20684 affects the vdec component and describes a use-after-free brought on by a race condition, enabling local escalation of privileges to SYSTEM with no user interaction required. The vulnerability is about memory mismanagement that could be exploited locally; exploitation details are n...

CVE-2023-20687

CVE-2023-20687 describes a race-condition that can cause a double free in the display DRM component, enabling local escalation of privileges to SYSTEM level without user interaction. The vulnerability is associated with a patch ID ALPS07570772 (Issue ID ALPS07570772). Exploitation status is not p...

CVE-2023-20691

CVE-2023-20691 affects MediaTek WLAN firmware, where an integer overflow can cause a system crash and remote denial of service. Exploitation requires no user interaction and no privileges. Root cause is not elaborated beyond the overflow in the WLAN firmware; no explicit exploit vectors are provi...

CVE-2023-20701

In the provided CVE-2023-20701 context, the issue is a vulnerability in the widevine module of MediaTek chips. The root cause is a logic error that can trigger an out-of-bounds write, potentially enabling local escalation of privileges with system execution rights. Exploitation requires no user i...

CVE-2023-20707

CVE-2023-20707 affects the ril component in MediaTek chips, caused by a missing bounds check that enables an out-of-bounds write. This could allow local escalation of privilege with System execution privileges required, and no user interaction is needed. The available fix/patch is ALPS07628556 (I...

CVE-2023-20710

The CVE-2023-20710 entry concerns the MediaTek keyinstall component, where an out-of-bounds read can occur due to a missing bounds check. This vulnerability could lead to local information disclosure with system-level privileges required for exploitation, and exploitation reportedly does not requ...

CVE-2023-20719

The CVE-2023-20719 issue affects the pqframework. It describes an out-of-bounds read caused by a missing bounds check, potentially enabling local information disclosure with high confidentiality impact and requiring system privileges, with no user interaction needed. Mitigation/Remediation: Patch...

CVE-2023-20757

The CVE-2023-20757 entry concerns the cmdq component, where a missing bounds check enables an out-of-bounds write. This can lead to local privilege escalation with SYSTEM execution privileges required and does not require user interaction. The vulnerability description is consistent across multip...

CVE-2023-20818

CVE-2023-20818 affects MediaTek WLAN service. The issue is an out-of-bounds read caused by improper input validation in the WLAN subsystem, enabling local information disclosure with SYSTEM-level privileges. Exploitation requires no user interaction. A patch/mitigation reference is Patch ID: ALPS...

CVE-2023-21235

CVE-2023-21235 involves a privilege bypass in LockSettingsActivity.java on Wear OS/Android where a new lock PIN can be set without entering the existing PIN. This is a local escalation of privilege (LOCAL) with no user interaction required; exploitation is tied to access to LockSettingsActivity.j...

CVE-2023-21303

CVE-2023-21303 is an information-disclosure flaw affecting Android where an attacker can infer whether an app is installed via a side channel without query permissions. It enables local information leakage with no user interaction and requires only local access. Android 14 release notes indicate ...

CVE-2023-21304

CVE-2023-21304 describes an information-disclosure flaw in Android’s Content Service that can reveal whether an app is installed without query permissions, via a side-channel. The issue allows local information leakage without extra execution privileges and does not require user interaction to ex...

CVE-2023-21338

CVE-2023-21338 affects Android’s Input Method. The issue is a side-channel information disclosure that lets an app determine whether another app is installed without query permissions, enabling local elevation of privilege with no additional execution privileges required. The Android 14 security ...

CVE-2023-30866

CVE-2023-30866 affects the telephony service, with a missing permission check that could lead to local information disclosure without extra privileges. The impact is described as high confidentiality risk but no exploitation details or specific vulnerable versions are provided in the connected do...

CVE-2023-30939

CVE-2023-30939 affects the telephony service with a missing permission check, enabling local information disclosure without extra privileges. Connected sources identify impacted platforms (e.g., UNISOC chipsets) and confirm the root cause as a lack of privilege validation in telephony components....

CVE-2023-33888

CVE-2023-33888 affects the telephony service with a missing permission check that can lead to local information disclosure. Connected documents identify these as UNISOC-chipset telephony services, listing affected devices such as SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T618/T612/T616/T820/S80...

CVE-2023-33894

The CVE-2023-33894 entry describes a vulnerability in the fastDial service where a missing permission check allows local information disclosure without additional execution privileges. Affected product scope is centered on fastDial-related implementations (e.g., UNISOC chipsets as referenced in r...

CVE-2023-33910

CVE-2023-33910 concerns the Contacts Service, where a missing permission check is reported to allow local information disclosure with no additional execution privileges. The NVD entry lists a CVSS v3.1 base score of 5.5 (Attack Vector: Local, Attack Complexity: Low, Privileges Required: Low, User...

CVE-2023-40632

The CVE-2023-40632 entry concerns the jpg driver, where a logic error can cause a use-after-free, enabling remote information disclosure without extra execution privileges. The vulnerability is associated with memory reuse after release, per multiple sources (e.g., Red Hat, NVD, PRION, CVE record...