CVE-2018-11906

CVE-2018-11906 affects Android releases (Android for MSM, Firefox OS for MSM, QRD Android) built from CAF Linux kernel. The vulnerability is due to default privileged access to ADB and debug-fs, enabling local attackers with low complexity to achieve high-impact confidentiality, integrity, and av...

CVE-2018-21041

CVE-2018-21041 affects Samsung mobile devices running O(8.x). The issue allows access to the Gallery inside the Secure Folder without authentication. The vulnerability is rooted in the Secure Folder access flow (exact root cause not detailed in the provided documents). Impact is elevated: unautho...

CVE-2018-21051

The CVE-2018-21051 entry concerns Samsung mobile devices with Exynos N(7.x) and O(8.x) software, where an invalid free in the fingerprint Trustlet can lead to arbitrary code execution. The vulnerability is supported by multiple connected records (e.g., NVD, Red Hat, CNVD) that describe the same i...

CVE-2018-21060

Technical details about CVE-2018-21060 are not publicly provided in the supplied documents. Monitor for updates. The records reiterate a Samsung keyboard-leak issue but do not specify affected components, versions, or fixes.

CVE-2018-21061

CVE-2018-21061 affects Samsung mobile devices running N(7.1) and O(8.x). The issue allows a counterfeit/“fake” charger to execute critical functions while the device is locked, enabling partial confidentiality, integrity, and availability impacts as indicated in CVSS vectors. The problem is descr...

CVE-2018-21083

CVE-2018-21083 affects Samsung mobile devices running M/N/O (6.0/7.x/8.0) on Exynos or Qualcomm chipsets. The issue is an information disclosure of a kernel address via trustonic_tee. Evidence across multiple sources (NVD entry, Red Hat advisory, CVE listing) confirms the vulnerability descriptio...

CVE-2018-21090

CVE-2018-21090 affects Samsung mobile devices with software up to 2017-11-03 on S.LSI Exynos modem chipsets, due to a baseband buffer overflow in the Exynos modem chipset. The issue is described across multiple sources (NVD entry, Red Hat advisory, CNVD entry, PRION page, CVE listing) with CVSS v...

CVE-2018-3560

CVE-2018-3560 describes a double-free in the Android sound path. Affected products include Android for MSM, Firefox OS for MSM, and QRD Android with CAF Linux-kernel branches. The root cause is a double-free in the Audio Driver when opening a sound compression device, leading to potential misuse ...

CVE-2018-3596

CVE-2018-3596 affects Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android builds that use CAF Android with the Linux kernel versions prior to the 2018-04-05 patch level. The vulnerability stems from legacy code that remained vulnerable after migration, with the note that this legacy cod...

CVE-2018-3597

CVE-2018-3597 affects the ADSP RPC driver in Android CAF builds using the Linux kernel (Android for MSM, Firefox OS for MSM, QRD Android). Before the 2018-06-05 security patch level, this issue could allow an arbitrary kernel write via a local attack on vulnerable devices. The CVSS metrics in the...

CVE-2018-5862

CVE-2018-5862 concerns Android CAF builds using the Linux kernel. In __wlan_hdd_cfg80211_vendor_scan(), when parsing SCAN_SSIDS and QCA_WLAN_VENDOR_ATTR_SCAN_FREQUENCIES, a buffer overwrite can potentially occur in all Android releases before patch level 2018-07-05. CVSS data in the entry shows l...

CVE-2018-5863

CVE-2018-5863 is a buffer overflow in WLAN HOST caused by an overly large WPA RSN IE length processed by wlan_hdd_cfg80211_set_ie(). Affected are Android releases (Android for MSM, Firefox OS for MSM, QRD Android) provided by CAF on the Linux kernel. The description confirms a memory corruption v...

CVE-2018-5893

CVE-2018-5893 is a buffer overwrite in the Qualcomm WLAN driver (htt_t2h_msg_handler_fast()) within Android CAF/Linux kernel for MSM devices. Root cause: buffer overwrite during firmware message processing. Affected: Qualcomm WLAN component in Android on CAF Android for MSM, Firefox OS for MSM, Q...

CVE-2018-5898

CVE-2018-5898 describes an integer overflow in the function msm_pcm_adsp_stream_cmd_put() within CAF Android for MSM Linux kernel code before the 2018-06-05 patch level. If user-supplied param_length exceeds a limit, the issue can affect local confidentiality, integrity, and availability (high im...

CVE-2018-6254

CVE-2018-6254 affects Android devices with NVIDIA Media Server prior to the 2018-05-05 patch level. The issue is an out-of-bounds read caused by improper input validation, enabling local information disclosure. The vulnerability is rated Moderate (CVSS v3 base score 3.3 / LOW) with Local access a...

CVE-2018-9523

CVE-2018-9523 affects Android 7.0–9 in Parcel.java’s Parcel.writeMapInternal, where a parcel serialization/deserialization mismatch arises from improper input validation. This creates local privilege escalation with no user interaction required; the issue is exploitable locally within affected An...

CVE-2018-9540

The CVE-2018-9540 issue affects Android’s Bluetooth stack. In avrc_ctrl_pars_vendor_rsp (avrc_pars_ct.c) a missing bounds check allows an out-of-bounds read, enabling remote information disclosure over Bluetooth without user interaction or added privileges. Affected: Android 7.0–9 (Android-7.0, 7...

CVE-2019-2032

CVE-2019-2032 affects Android devices (Android 8.0, 8.1, 9) and is tied to the function in ble_advertiser_hci_interface.cc: SetScanResponseData. The issue is an out-of-bounds write caused by a missing bounds check, leading to local elevation of privilege with no additional execution privileges re...

CVE-2019-2055

CVE-2019-2055 affects Android 10 via the libxaac library, where an out-of-bounds write due to a missing bounds check enables remote code execution with the attacker needing no privileges and requiring user interaction. The issue is documented across multiple feeds (NVD, RH, CNVD) and is associate...

CVE-2019-20554

Technical details about CVE-2019-20554 are not publicly provided in the supplied documents. The collection notes FRP bypass on Samsung devices via an external keyboard, but no vendor/product/version specifics or remediation are given. Monitor for updates.

CVE-2019-20581

CVE-2019-20581 describes a stack overflow in the HDCP Trustlet on Samsung mobile devices with Exynos chipsets (N7.x, O8.x, P9.0), leading to arbitrary code execution. Affected component is the HDCP Trustlet; root cause is a stack overflow. Impact is rated high to critical in CVSS terms (in the pr...

CVE-2019-20592

CVE-2019-20592 affects Samsung mobile devices running N(7.x), O(8.x) and P(9.0). The issue is a local SQL injection in the Story Video Editor Content Provider, with Samsung ID SVE-2019-14062. Connected documents corroborate this vulnerability and do not provide concrete patch versions or remediat...

CVE-2019-20622

CVE-2019-20622 affects Samsung mobile devices running N(7.x), O(8.x), and P(9.0) on Exynos chipsets, via a baseband stack overflow. The issue is identified with Samsung’s internal reference SVE-2018-13188 (Feb 2019). The NVD entry lists a high-severity, network-exposed vulnerability with a base s...

CVE-2019-2071

CVE-2019-2071 affects Android 10 via the libxaac library. The issue is an out-of-bounds write caused by a missing bounds check in libxaac, enabling remote code execution with no required privileges and with user interaction needed to exploit. The impact is consistent with a high-severity remote c...

CVE-2019-2074

This entry concerns CVE-2019-2074 affecting libxaac in Android 10. The issue is an out-of-bounds write due to a missing bounds check, enabling remote code execution. Impact: remote code execution with user interaction required, configured as HIGH in CVSS 3.1. Affected component: libxaac in Androi...

CVE-2019-20773

CVE-2019-20773 affects LG mobile devices running Android OS 7.x–9.0; the issue allows unprivileged applications to execute shell commands via the connectivity service. Root cause is not detailed in the provided documents; no exploit specifics or remediation are described in the connected sources....

CVE-2019-2082

CVE-2019-2082 is a vulnerability in the Android libxaac library where an out-of-bounds write arises from a missing bounds check in libxaac. The issue could enable remote code execution on Android 10 with no extra privileges, and exploitation requires user interaction. Affected component: libxaac ...

CVE-2019-2167

The CVE-2019-2167 entry concerns Google Android 10’s libxaac, where information disclosure can occur due to uninitialized data. Affected component/file: libxaac within Android 10. Root cause: uninitialized data leads to partial confidentiality impact (information disclosure) without executing cod...

CVE-2019-9240

CVE-2019-9240 affects Android 10 NFC: an out-of-bounds read caused by a missing bounds check could disclose local information. Exploitation requires user interaction; no exploit details or patch information are provided in the connected documents.

CVE-2019-9260

CVE-2019-9260 affects Android 10 and is a Bluetooth information-disclosure vulnerability caused by an out-of-bounds read from an incorrect bounds check. Exploitation is possible remotely over a network with no user interaction, potentially leading to partial confidentiality loss. NVD metrics show...

CVE-2019-9265

CVE-2019-9265 affects Android 10 Bluetooth, where an incorrect bounds check enables an out-of-bounds read that could disclose information remotely without extra privileges or user interaction. Documented impact is information disclosure; no exploitation details are provided in the available sourc...

CVE-2019-9300

CVE-2019-9300 describes a vulnerability in Android 10’s Media Framework (libAACdec) where an integer overflow can trigger an out-of-bounds write, enabling remote code execution. The issue affects Android 10 and is associated with Android’s libAACdec component; the root cause is an out-of-bounds w...

CVE-2019-9326

CVE-2019-9326 affects Android 10 Bluetooth: a missing bounds check in the Bluetooth stack enables an out-of-bounds read that can disclose remote information without requiring privileges or user interaction. Impact is information disclosure; CVSS v3.1 base score 7.5 (HIGH), network attack vector, ...

CVE-2019-9333

CVE-2019-9333 affects Android 10 Bluetooth. Root cause: a missing bounds check causes an out-of-bounds read, enabling remote information disclosure without additional execution privileges and without user interaction. CVSS metrics show network attack with low complexity (CVSSv3.1: AV:N/AC:L/PR:N/...

CVE-2019-9414

CVE-2019-9414 affects wpa_supplicant on Android 10. The root cause is improper input validation of the basicConstraints field in intermediary certificates, enabling a remote information disclosure via a man‑in‑the‑middle scenario with no user interaction. Impact is partial confidentiality loss; n...

CVE-2019-9462

Technical details about CVE-2019-9462 are not available in the provided connected documents. The initial description confirms a Bluetooth out-of-bounds read causing DoS on Android 10, but no product/version specifics or exploitation details are disclosed here. Monitor for updates.

CVE-2019-9470

CVE-2019-9470 is an Android kernel vulnerability affecting the dma_sblk_start path in abc-pcie.c. The issue is an out-of-bounds write caused by a missing bounds check, enabling local escalation of privilege with system execution privileges required; no user interaction is needed. Publicly documen...

CVE-2020-0021

CVE-2020-0021 affects Android 10 in the PackageManagerService.removeUnusedPackagesLPw path, where a missing package dependency test can cause a permanent denial-of-service. The vulnerability description states that remote DoS is possible with user privileges and no user interaction required. Conn...

CVE-2020-0037

CVE-2020-0037 affects Android, focusing on rw_i93_sm_set_read_only in rw_i93.cc. The vulnerability is an out-of-bounds read caused by a missing bounds check in this function, enabling remote information disclosure over NFC without additional execution privileges. Affected Android versions include...

CVE-2020-0130

CVE-2020-0130 affects Android 11 screencap. The issue is command injection due to improper input validation in screencap, enabling local elevation of privilege with User-level privileges and no user interaction required. Impact is local, affecting system processes; exploitation would require acce...

CVE-2020-0137

CVE-2020-0137 is an Elevation of Privilege vulnerability in Android 10 where the code path setIPv6AddrGenMode in NetworkManagementService.java bypasses a required networking permission due to a missing permission check. This could allow a locally authenticated attacker to gain privileges with no ...

CVE-2020-0180

CVE-2020-0180 affects Android 10 (Media Framework). Vulnerability arises from a missing bounds check in GetOpusHeaderBuffers() within OpusHeader.cpp, causing an out-of-bounds read that can disclose information remotely. Exploitation requires user interaction. Public references in the Pixel Update...

CVE-2020-0200

CVE-2020-0200 is an Android 10 issue affecting the Media Framework: a missing bounds check in ReadLittleEndian within raw_bit_reader.cc can trigger an out-of-bounds read and information disclosure. The NVD entry notes network access as the attack vector with no execution privileges, while the CVS...

CVE-2020-0216

Technical details about CVE-2020-0216 are not publicly provided in the supplied documents. Monitor for updates.

CVE-2020-0233

CVE-2020-0233 describes a memory corruption in Android’s kernel due to a use-after-free in main.cpp, enabling local elevation of privilege without extra user interaction. Documented impact: local attacker could escalate privileges; exploitation status is not provided in the sources. Affected comp...

CVE-2020-0234

CVE-2020-0234 affects the Android kernel audio component (kernel driver for msm-cirrus playback). The issue is in crus_afe_get_param in msm-cirrus-playback.c, where a missing bounds check allows an out-of-bounds write. This can enable local privilege escalation with no extra privileges and no use...

CVE-2020-0298

CVE-2020-0298: A local elevation-of-privilege in Android 11 Bluetooth due to a missing permission check that allows an attacker to enable/disable Bluetooth without user interaction. Affects Bluetooth subsystem; root cause is lack of permission validation in Bluetooth flow, enabling local privileg...

CVE-2020-0304

CVE-2020-0304 affects Android 11; a flaw in Settings allows an unsafe PendingIntent to bypass permission, leading to local information disclosure with no user interaction. The root cause is inadequate validation of PendingIntent handlers, enabling a local attacker with physical or remote access t...

CVE-2020-0328

CVE-2020-0328 affects Android 11, with a vulnerability in the camera component where an integer overflow can trigger an out-of-bounds read. This may lead to local information disclosure and system-level execution privileges, without user interaction. The issue is documented across multiple source...

CVE-2020-0345

CVE-2020-0345 affects Android 11 DocumentsUI, enabling a local elevation of privilege via a permission bypass (confused deputy). Impact: partial/full escalation on affected builds; CVSS v3.1: LOCAL, LOW complexity, UI REQUIRED, with HIGH confidentiality, integrity, and availability impacts. Root ...