CVE-2020-10829

CVE-2020-10829 affects Samsung mobile devices running Android O–Q on Broadcom-based hardware. The root cause is a kernel driver heap overflow, enabling arbitrary code execution. Samsung’s internal tracker is SVE-2019-15880 (March 2020). Documented in multiple feeds; in CMP context, no exploit det...

CVE-2020-10836

CVE-2020-10836 affects Samsung mobile devices with Exynos (O(8.x), P(9.0), Q(10.0)). The Widevine Trustlet permits read/write access to arbitrary memory, indicating a memory-safety/Trustlet isolation flaw. CVSSv3.1 base score 9.8 (CRITICAL); access is network-based with no authentication required...

CVE-2020-10837

The CVE-2020-10837 vulnerability affects Samsung mobile devices running P(9.0) and Q(10.0) with TEEGRIS. The issue resides in the Esecomm Trustlet, enabling a stack overflow that can lead to arbitrary code execution. Affected software/component: Esecomm Trustlet within Samsung TEEGRIS on P9.0/Q10...

CVE-2020-10850

The CVE-2020-10850 entry describes a buffer overflow in the secure bootloader USB path on Samsung mobile devices with Exynos SoCs (Android O[8.x], P[9.0], Q[10.0]), enabling arbitrary code execution. The issue is tied to the secure bootloader’s handling of USB buffers (root cause: buffer overflow...

CVE-2020-11602

Technical details about CVE-2020-11602 are not publicly available in the provided documents. Monitor for updates from NVD/Red Hat/CVE sources as more information may be released.

CVE-2020-15578

The CVE-2020-15578 entry concerns Samsung mobile devices running O(8.x) software where the FactoryCamera component does not properly restrict runtime permissions. Affected software is described as Samsung devices with that Android/OS lineage; the root cause is the improper permission restriction ...

CVE-2020-15580

Samsung mobile devices running O(8.x), P(9.0), and Q(10.0) are affected by CVE-2020-15580, allowing attackers to bypass Factory Reset Protection by enrolling a new lock password. Root cause details are not provided in the documents. Impact is FRP bypass; no exploit vectors or in-the-wild details ...

CVE-2020-15584

CVE-2020-15584 affects Samsung mobile devices running Q(10.0). The issue arises when processing a 4K wallpaper image, where ImageProcessHelper mishandles boundary checks, causing out-of-bounds access that can lead to a device reset. Samsung’s internal ID for this vulnerability is SVE-2020-18056 (...

CVE-2020-25057

CVE-2020-25057 affects LG mobile devices running Android 10, where MDMService does not properly restrict APK installations. This is the core described issue across multiple sources linked to LG’s LVE-SMP-200011 (July 2020). Concrete details in the connected documents are limited to the affected c...

CVE-2020-25278

Summary of CVE-2020-25278 (Samsung) : The vulnerability affects Samsung mobile devices running O(8.x), P(9.0), and Q(10.0). The issue stems from the Quram image codec library, which can be exploited by crafted JPEG data to overwrite memory and execute arbitrary code during decoding. Impact is des...

CVE-2020-27033

CVE-2020-27033 affects Android’s NFC stack (nfc_ncif_proc_get_routing in nfc_ncif.cc). A missing bounds check can cause an out-of-bounds read, enabling local information disclosure with potential system-level execution privileges. Exploitation is local and does not require user interaction. Publi...

CVE-2020-27038

CVE-2020-27038 affects Android 11 with a memory-leak in C2SoftVorbisDec.cpp that can exhaust memory and cause remote denial of service. Exploitation requires user interaction; no explicit exploit details are provided in the connected documents. The available sources confirm the DoS impact and the...

CVE-2020-27043

CVE-2020-27043 refers to an out-of-bounds read in the Android NFC stack. Specifically, the issue is described in nfc_enabled of nfc_main.cc, caused by an incorrect increment, leading to possible local information disclosure when firmware runs with system privileges. Affected product is Android 11...

CVE-2020-35553

CVE-2020-35553 affects Samsung mobile devices running Android Q (10.0) and R (11.0) on Qualcomm SM8250 chipsets. The issue allows a denial of service (unlock failure) by triggering a power-shortage incident that leads to a false-positive attack detection. No concrete exploit details, affected sof...

CVE-2021-0409

CVE-2021-0409 affects the MediaTek flv extractor, where an out-of-bounds read can occur due to an incorrect bounds check. This may lead to local information disclosure without requiring user interaction. The issue is documented with patch ID ALPS05561359 / Issue ID ALPS05561359. Connected sources...

CVE-2021-0411

CVE-2021-0411 affects the MediaTek flv extractor. The vulnerability is an out-of-bounds read caused by an integer overflow in the component, enabling local information disclosure without additional execution privileges or user interaction. Mitigation/patch reference: ALPS05561362 (Issue ID ALPS05...

CVE-2021-0497

CVE-2021-0497 describes a memory corruption vulnerability in the Android memory management driver caused by a use-after-free. This can enable local escalation of privilege without user interaction. Affected component is the Android memory management driver on Android SoCs with Android ID A-183461...

CVE-2021-0618

CVE-2021-0618 affects MediaTek’s ape extractor. The vulnerability is a heap buffer overflow that can enable a local out-of-bounds read leading to information disclosure, with no user interaction required. Patch ID ALPS05561394 addresses the issue. Exploitation details are not provided in the acce...

CVE-2021-0660

The CVE-2021-0660 issue concerns the ccu component with an out-of-bounds read caused by incorrect error handling, enabling information disclosure potentially with System privileges. No user interaction is required. A patch is identified as ALPS05827145 (Issue ALPS05827145). RH and NVD entries cor...

CVE-2021-22495

CVE-2021-22495 affects Samsung mobile devices with Exynos SoCs (O/8.x, P/9.0, Q/10.0, R/11.0) where the Mali GPU driver permits out-of-bounds access and can trigger a device reset. This is documented across multiple sources in the connected docs (NVD, Red Hat advisory, CVE records), referencing S...

CVE-2021-25386

Summary: The vulnerability CVE-2021-25386 affects the Samsung libsdffextractor library, specifically the improper input validation in the function sdfffd_parse_chunk_FVER(). This can allow attackers to execute arbitrary code on the mediaextractor process. Affected component: libsdffextractor (pri...

CVE-2021-25390

CVE-2021-25390 corresponds to an intent redirection vulnerability in Samsung’s PhotoTable within the SMR MAY-2021 Release 1. Affected component/file: PhotoTable (Samsung’s software update stack). Root cause and impact, as documented: it enables an attacker with local access to perform a privilege...

CVE-2021-25462

CVE-2021-25462 describes a NULL pointer dereference in Samsung NPU driver prior to SMR Sep-2021 Release 1, leading to memory corruption. The vulnerability is local (attack vector: LOCAL) with low attack complexity per CVSS v3.1, and impacts memory integrity/availability as specified. Affected com...

CVE-2021-25482

CVE-2021-25482 refers to a SQL injection vulnerability in the CMFA framework, prior to Samsung SMR Oct-2021 Release 1. According to connected sources (NVD, Red Hat, CVE listings, PRION, CNNVD, and others), the issue allows an untrusted application to overwrite some CMFA framework information. The...

CVE-2021-25514

Technical details about CVE-2021-25514 are not publicly available in the provided connected documents. Monitor for updates from official advisories.

CVE-2022-33700

CVE-2022-33700 affects Samsung TelephonyUI, specifically the putDsaSimImsi path. The vulnerability arises from inadequate protection of sensitive information in TelephonyUI, enabling a local attacker to read IMSI values via logs. The issue is rooted in information disclosure within the putDsaSimI...

CVE-2022-39122

The CVE-2022-39122 entry describes a vulnerability in a sensor driver where a missing bounds check can cause an out-of-bounds write, leading to local denial of service in the kernel. Connected sources reference Unisoc chipsets (e.g., SC9863A/SC9832E/SC7731E and related Android versions) and reite...

CVE-2022-47353

CVE-2022-47353 affects the vdsp device. The root cause is improper input validation that can cause a system crash, leading to local denial of service with system execution privileges. Documents describe this as a local issue with high availability impact; there is no publicly available exploit in...

CVE-2022-47498

The CVE-2022-47498 entry relates to the UNISOC/UNISOC soter service. The root cause described across connected documents is a missing bounds check that enables an out-of-bounds write. Impact specified is local denial of service with system‑level execution privileges required, and the CVSS indicat...

CVE-2022-48238

CVE-2022-48238 affects UNISOC chipsets’ Image filter module. The root cause is a missing bounds check that enables out-of-bounds writes, leading to local denial of service with System execution privileges required. Documents consistently describe the impact as local DoS with high availability imp...

CVE-2022-48239

CVE-2022-48239 is a camera driver vulnerability describing an out-of-bounds write caused by a missing bounds check, leading to local denial of service with System-level privileges required. Connected sources identify this as affecting UNISOC camera driver code (notably on Unisoc/SC-series chipset...

CVE-2023-20643

The CVE-2023-20643 entry refers to the ril module in MediaTek chips, describing a possible out-of-bounds write caused by a missing bounds check. This could lead to local escalation of privilege with System execution privileges required, and no user interaction is needed. The exploit status is not...

CVE-2023-20670

The CVE-2023-20670 entry describes a local out-of-bounds write in audio caused by a missing bounds check, enabling local escalation to System execution privileges without user interaction. The vulnerability is associated with MediaTek audio components and is tied to patch ALPS07648710 (Issue ALPS...

CVE-2023-20684

CVE-2023-20684 affects the vdec component and describes a use-after-free brought on by a race condition, enabling local escalation of privileges to SYSTEM with no user interaction required. The vulnerability is about memory mismanagement that could be exploited locally; exploitation details are n...

CVE-2023-20691

CVE-2023-20691 affects MediaTek WLAN firmware, where an integer overflow can cause a system crash and remote denial of service. Exploitation requires no user interaction and no privileges. Root cause is not elaborated beyond the overflow in the WLAN firmware; no explicit exploit vectors are provi...

CVE-2023-20720

CVE-2023-20720 affects the pqframework component. The issue is an out-of-bounds read caused by a missing bounds check, enabling local escalation of privilege with SYSTEM-level execution privileges required. Exploitation does not require user interaction. The code is associated with patch ALPS0762...

CVE-2023-20753

CVE-2023-20753 affects rpmb (MediaTek context in multiple feeds). A logic error enables an out-of-bounds write, which could lead to local privilege escalation with SYSTEM execution privileges required. Exploitation does not require user interaction. A patch is referenced as ALPS07460390 (Issue AL...

CVE-2023-20772

CVE-2023-20772 affects the vow component, where a missing permission check enables local escalation of privilege without requiring user interaction. The issue can be exploited locally to gain higher privileges, as indicated by the CVSS data (LOCAL vector, high confidentiality/integrity/availabili...

CVE-2023-20818

CVE-2023-20818 affects MediaTek WLAN service. The issue is an out-of-bounds read caused by improper input validation in the WLAN subsystem, enabling local information disclosure with SYSTEM-level privileges. Exploitation requires no user interaction. A patch/mitigation reference is Patch ID: ALPS...

CVE-2023-21235

CVE-2023-21235 involves a privilege bypass in LockSettingsActivity.java on Wear OS/Android where a new lock PIN can be set without entering the existing PIN. This is a local escalation of privilege (LOCAL) with no user interaction required; exploitation is tied to access to LockSettingsActivity.j...

CVE-2023-21260

CVE-2023-21260 affects Android Automotive OS (AAOS) Packages component. A malicious app can exploit the notification access permission dialog by embedding an excessively long service label that can overflow the user prompt and display misleading information as a system message for user confirmati...

CVE-2023-21299

CVE-2023-21299 affects Android’s Package Manager, allowing an attacker to determine whether an app is installed via a side‑channel information disclosure. Impact: local information disclosure without extra privileges or user interaction. The vulnerability is described in multiple sources (includi...

CVE-2023-21300

Summary: CVE-2023-21300 affects Android’s PackageManager and arises from a side-channel information disclosure that allows a local attacker to infer whether an app is installed without query permissions. This is described as a local information disclosure with no additional execution privileges r...

CVE-2023-21303

CVE-2023-21303 is an information-disclosure flaw affecting Android where an attacker can infer whether an app is installed via a side channel without query permissions. It enables local information leakage with no user interaction and requires only local access. Android 14 release notes indicate ...

CVE-2023-30863

CVE-2023-30863 concerns the Connectivity Service and cites a missing permission check as the root cause. The vulnerability enables local escalation of privilege with no additional execution privileges, matching CVSS 3.1 metrics: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (base score 7.8). The connected ...

CVE-2023-30864

Publicly available documents provided here do not contain concrete technical details (affected version, component specifics, exploit info). Technical specifics are not publicly disclosed in the supplied sources. Monitor for updates.

CVE-2023-30866

CVE-2023-30866 affects the telephony service, with a missing permission check that could lead to local information disclosure without extra privileges. The impact is described as high confidentiality risk but no exploitation details or specific vulnerable versions are provided in the connected do...

CVE-2023-32852

CVE-2023-32852 affects the cameraisp module. The vulnerability is an information disclosure caused by improper input validation, enabling local disclosure with SYSTEM privileges required and no user interaction. The documented attack vector is LOCAL with HIGH privileges required; no exploitation ...

CVE-2023-33894

The CVE-2023-33894 entry describes a vulnerability in the fastDial service where a missing permission check allows local information disclosure without additional execution privileges. Affected product scope is centered on fastDial-related implementations (e.g., UNISOC chipsets as referenced in r...

CVE-2023-33910

CVE-2023-33910 concerns the Contacts Service, where a missing permission check is reported to allow local information disclosure with no additional execution privileges. The NVD entry lists a CVSS v3.1 base score of 5.5 (Attack Vector: Local, Attack Complexity: Low, Privileges Required: Low, User...