CVE-2018-11903

CVE-2018-11903 affects CAF Android builds (Android for MSM, Firefox OS for MSM, QRD Android) that use the Linux kernel. The vulnerability arises from a lack of length validation for a value received from a caller function that is used as an index into WMA interfaces, enabling an out-of-bounds wri...

CVE-2018-11962

CVE-2018-11962 affects Qualcomm audio components. The issue is a Use-After-Free in the heap during loading of audio effects config in the audio effects factory. It is a local (LOCAL) vulnerability with low attack complexity and requires no user interaction, per CVSS data (AV:L, AC:L, PR:L, UI:N, ...

CVE-2018-11963

CVE-2018-11963 affects Android platforms based on CAF’s Linux kernel, with the issue localized to the camera JPEG driver. The root cause is a buffer overread caused by non-null terminated strings during processing of vsprintf, potentially enabling a local attacker with access to expose or corrupt...

CVE-2018-11983

CVE-2018-11983 affects Android releases (Android for MSM, Firefox OS for MSM, QRD Android) built on CAF’s Linux kernel. The vulnerability is a kernel memory-management error where code accesses freed mask pointers after reallocating memory for a mask table, constituting a fault in the kernel’s ha...

CVE-2018-21044

CVE-2018-21044 affects Samsung mobile devices running N(7.x) and O(8.0). The issue is a buffer overflow in the sem Trustlet that can lead to arbitrary TEE code execution. Samsung IDs: SVE-2018-13230/13231/13232/13233. Connected sources confirm the fault and indicate a Samsung security update refe...

CVE-2018-21056

CVE-2018-21056 affects Samsung mobile devices running O(8.x). The issue involves Smartwatch displaying Secure Folder Notification content, as described across multiple feeds (Samsung security advisory, Red Hat CVE page, NVD entry). The core impact is unintended disclosure of Secure Folder notific...

CVE-2018-21060

Technical details about CVE-2018-21060 are not publicly provided in the supplied documents. Monitor for updates. The records reiterate a Samsung keyboard-leak issue but do not specify affected components, versions, or fixes.

CVE-2018-21061

CVE-2018-21061 affects Samsung mobile devices running N(7.1) and O(8.x). The issue allows a counterfeit/“fake” charger to execute critical functions while the device is locked, enabling partial confidentiality, integrity, and availability impacts as indicated in CVSS vectors. The problem is descr...

CVE-2018-21068

The CVE-2018-21068 entry describes a vulnerability affecting Samsung mobile devices running Android O (8.0). In Secure Folder mode, an application can be executed without entering a password through a split-screen scenario. Root cause/details are not fully disclosed in the provided documents; no ...

CVE-2018-21071

Technical details about CVE-2018-21071 are not publicly provided in the connected documents. Monitor for updates from vendors and security advisories for affected products and remediation.

CVE-2018-21084

Samsung mobile devices running L(5.1), M(6.0), and N(7.x) contain a race condition leading to a read-after-free in get_kek (CVE-2018-21084; Samsung ID SVE-2017-11174). Connected sources confirm the vulnerability exists but do not specify affected models beyond the Android/Samsung platforms or pro...

CVE-2018-3587

CVE-2018-3587 is tied to the Qualcomm qcacld-2.0 WLAN driver in Android CAF builds, where a Use-After-Free in a firmware memory dump feature can lead to Elevation of Privilege (EoP). The NVD listing shows a CVSS v3 base score of 7.8 (HIGH) with LOCAL attack vector, low complexity, and privileges ...

CVE-2018-3596

CVE-2018-3596 affects Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android builds that use CAF Android with the Linux kernel versions prior to the 2018-04-05 patch level. The vulnerability stems from legacy code that remained vulnerable after migration, with the note that this legacy cod...

CVE-2018-5821

In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with CAF builds prior to the 2018-04-05 kernel patch level, CVE-2018-5821 is a memory error in wma_wow_wakeup_host_event() where wake_info->vdev_id from FW is used as an index into wma->interfaces, potentially reading beyond t...

CVE-2018-5850

CVE-2018-5850 affects Android CAF/Linux kernel components. The vulnerability arises from insufficient validation of a key length in csr_update_fils_params_rso(), which can cause an integer underflow and lead to a buffer overflow in affected Android releases using the Linux kernel. Provided docume...

CVE-2018-5862

CVE-2018-5862 concerns Android CAF builds using the Linux kernel. In __wlan_hdd_cfg80211_vendor_scan(), when parsing SCAN_SSIDS and QCA_WLAN_VENDOR_ATTR_SCAN_FREQUENCIES, a buffer overwrite can potentially occur in all Android releases before patch level 2018-07-05. CVSS data in the entry shows l...

CVE-2018-5897

CVE-2018-5897 affects Qualcomm diag in Android CAF/Linux kernel on Android for MSM, Firefox OS for MSM, and QRD Android. The issue stems from improper validation of len in dci_process_ctrl_status(), causing a buffer over-read that can disclose data (information disclosure). Public references indi...

CVE-2018-5898

CVE-2018-5898 describes an integer overflow in the function msm_pcm_adsp_stream_cmd_put() within CAF Android for MSM Linux kernel code before the 2018-06-05 patch level. If user-supplied param_length exceeds a limit, the issue can affect local confidentiality, integrity, and availability (high im...

CVE-2018-5905

CVE-2018-5905 describes a race condition in the Qualcomm Diag driver used in CAF Android builds (Android for MSM, Firefox OS for MSM, QRD Android) that can occur when accessing the number of clients in DIAG services, potentially leading to out-of-bounds access. Affected component is the Diag driv...

CVE-2018-6254

CVE-2018-6254 affects Android devices with NVIDIA Media Server prior to the 2018-05-05 patch level. The issue is an out-of-bounds read caused by improper input validation, enabling local information disclosure. The vulnerability is rated Moderate (CVSS v3 base score 3.3 / LOW) with Local access a...

CVE-2018-9457

CVE-2018-9457 concerns Android devices where, in BluetoothPairingController.java during onCheckedChanged, a permissions bypass could allow an attacker to retrieve contact information, leading to local information disclosure without additional privileges and without user interaction. Affected vers...

CVE-2018-9514

CVE-2018-9514 is a kernel vulnerability affecting Android devices, caused by a Use After Free in sdcardfs_open (file.c) that could enable local escalation of privilege without user interaction. The issue is within the Android kernel and is listed in the 2018-10 Android security bulletin; patch gu...

CVE-2018-9523

CVE-2018-9523 affects Android 7.0–9 in Parcel.java’s Parcel.writeMapInternal, where a parcel serialization/deserialization mismatch arises from improper input validation. This creates local privilege escalation with no user interaction required; the issue is exploitable locally within affected An...

CVE-2019-2032

CVE-2019-2032 affects Android devices (Android 8.0, 8.1, 9) and is tied to the function in ble_advertiser_hci_interface.cc: SetScanResponseData. The issue is an out-of-bounds write caused by a missing bounds check, leading to local elevation of privilege with no additional execution privileges re...

CVE-2019-20569

CVE-2019-20569 affects Samsung mobile devices running Android P (9.0). The vulnerability enables bypassing Factory Reset Protection (FRP) via manipulation of the status bar, as described in Red Hat and NVD references (Samsung ID SVE-2019-15089). Public details consistently state the issue as an F...

CVE-2019-2058

CVE-2019-2058 concerns a vulnerability in the Android 10 library component libAACdec where an out-of-bounds read can lead to remote information disclosure . The entry states that exploitation requires user interaction and that the affected product is Android 10. Connected sources corroborate the ...

CVE-2019-20587

CVE-2019-20587 corresponds to a type-confusion vulnerability in Samsung mobile devices running O(8.1) and P(9.0) with TEEGRIS. The issue is in the MLDAP Trustlet, enabling arbitrary code execution due to a type confusion flaw. Samsung ID: SVE-2019-14867 (August 2019). Connected sources (Red Hat, ...

CVE-2019-20618

The vulnerability CVE-2019-20618 affects Samsung mobile devices on Android P (9.0) where the Pin Window feature allows unauthenticated unpinning of an app. The connected Red Hat/EUVD/CNVD/etc. records mirror the same description and confirm the issue stems from Pin Window behavior; no explicit ro...

CVE-2019-2073

CVE-2019-2073 affects the Android 10 libxaac library, where an out-of-bounds write occurs due to a missing bounds check. This can lead to remote code execution with network access and no extra privileges, with user interaction required for exploitation. The vulnerability is documented across seve...

CVE-2019-2074

This entry concerns CVE-2019-2074 affecting libxaac in Android 10. The issue is an out-of-bounds write due to a missing bounds check, enabling remote code execution. Impact: remote code execution with user interaction required, configured as HIGH in CVSS 3.1. Affected component: libxaac in Androi...

CVE-2019-2075

CVE-2019-2075 affects libxaac on Android 10, where a missing bounds check allows an out-of-bounds write that can lead to remote code execution. Exploitation requires user interaction; impact is remote code execution with high severity in the Android 10 context. The issue is confirmed across multi...

CVE-2019-2082

CVE-2019-2082 is a vulnerability in the Android libxaac library where an out-of-bounds write arises from a missing bounds check in libxaac. The issue could enable remote code execution on Android 10 with no extra privileges, and exploitation requires user interaction. Affected component: libxaac ...

CVE-2019-2088

CVE-2019-2088 affects Android 10, specifically the StatsService component. The flaw is an out-of-bounds read in StatsService that could lead to local information disclosure without user interaction, with UBSAN being a factor. The public documents consistently reference Android-10 as affected; no ...

CVE-2019-2165

CVE-2019-2165 affects the Android libxaac library in Android 10, where an out-of-bounds read can occur due to a missing bounds check. This could lead to information disclosure without executing code, with user interaction required for exploitation. The provided documents consistently describe the...

CVE-2019-9240

CVE-2019-9240 affects Android 10 NFC: an out-of-bounds read caused by a missing bounds check could disclose local information. Exploitation requires user interaction; no exploit details or patch information are provided in the connected documents.

CVE-2019-9241

CVE-2019-9241 affects Android 10 Bluetooth, describing an out-of-bounds read due to a missing bounds check that could enable remote information disclosure with no user interaction or privileges. CVSS indicates network-based exploitation with high confidentiality impact. Remediation is provided by...

CVE-2019-9307

CVE-2019-9307 affects Android 10 libAACdec in the Media framework, with an integer overflow causing an out-of-bounds write and remote code execution; user interaction is required for exploitation. Android 10 security release notes indicate fixes with patch level 2019-09-01 or later, but no exploi...

CVE-2019-9313

CVE-2019-9313 affects the Android 10 media framework (libstagefright). The issue is a missing variable initialization in the media path, enabling a remote information disclosure when exploited against the library’s media handling. Exploitation requires user interaction. Impact is information disc...

CVE-2019-9314

CVE-2019-9314 affects Android 10 in the libavc component, where a missing variable initialization leads to remote information disclosure. The issue can be exploited without privileges via a network vector, but requires user interaction to trigger. The exploit details, affected versions beyond And...

CVE-2019-9320

CVE-2019-9320 relates to the Android media stack (libavc) with a missing variable initialization. The issue affects Android 10 and can lead to remote information disclosure without extra privileges; exploitation requires user interaction. The published details describe Information Disclosure as t...

CVE-2019-9334

CVE-2019-9334 concerns the Android 10 ecosystem where a vulnerability in the Media/Library stack (libhevc) allows information disclosure via uninitialized data. The issue affects Android 10 and is described as enabling remote information disclosure with no additional execution privileges; exploit...

CVE-2019-9341

Summary : CVE-2019-9341 is a Bluetooth vulnerability in Android 10 where an out-of-bounds read occurs due to a missing bounds check. This could allow remote information disclosure without extra execution privileges and without user interaction. Affected component : Bluetooth stack on Android 10. ...

CVE-2019-9352

CVE-2019-9352 affects the Android Media framework (libstagefright) on Android 10, where a missing bounds check can cause resource exhaustion and remote denial of service. The issue requires user interaction to exploit and is reported as a DoS with an impact to availability. Root cause: insufficie...

CVE-2019-9381

CVE-2019-9381 affects Android’s netd, with an out-of-bounds read caused by a use-after-free. This leads to remote information disclosure without additional privileges or user interaction on Android 10. The available documents confirm the vulnerable component and the impact but do not provide expl...

CVE-2019-9393

CVE-2019-9393 affects Android 10 Bluetooth, where a missing bounds check in the Bluetooth stack can allow a remote denial-of-service without user interaction. The impact is a DoS with high CVSS 3.1 base (HIGH) and network attack vector, though exploitation details are not provided in the provided...

CVE-2019-9397

CVE-2019-9397 affects the Bluetooth component in Android 10. The issue is a missing bounds check that can cause a controlled termination, yielding a remote DoS without needing privileges or user interaction. The vulnerability is documented with Android 10 as affected, and remediation is noted in ...

CVE-2019-9427

This entry covers CVE-2019-9427 affecting Android 10 with a Bluetooth use‑after‑free leading to local information disclosure without user interaction. Affected component: Bluetooth stack; root cause: use‑after‑free in Bluetooth handling. Impact: partial confidentiality loss (per CVSS v2) and high...

CVE-2019-9459

The CVE-2019-9459 entry concerns the Android 10 library libttspico. A heap buffer overflow leads to an out-of-bounds write, enabling remote escalation of privilege without user interaction. Documents specify the affected component (libttspico), the vulnerability class (OOB write due to a heap ove...

CVE-2020-0011

CVE-2020-0011 affects the FPC Fingerprint TEE in Android kernels. The description in multiple sources states an out-of-bounds write in get_auth_result of fpc_ta_hw_auth.c due to a missing bounds check, enabling local elevation of privilege with System-level privileges required. Exploitation is de...

CVE-2020-0037

CVE-2020-0037 affects Android, focusing on rw_i93_sm_set_read_only in rw_i93.cc. The vulnerability is an out-of-bounds read caused by a missing bounds check in this function, enabling remote information disclosure over NFC without additional execution privileges. Affected Android versions include...