CVE-2020-0165

CVE-2020-0165 affects Android 10. The issue is a potential out-of-bounds write in phNxpNciHal_NfcDep_cmd_ext (nfc driver code), caused by a missing bounds check, enabling local escalation of privilege with System execution privileges; no user interaction required. CVSSv3.1 base score 6.7 (Local, ...

CVE-2020-0171

CVE-2020-0171 affects Android 10; in Parse_lart of eas_mdls.c, a missing bounds check can cause resource exhaustion leading to remote denial of service. Exploitation requires user interaction. Affected platform details are reflected in Google's Pixel bulletin (patch level 2020-06-05 or later) and...

CVE-2020-0173

CVE-2020-0173 affects Android 10 in the Media Framework/eas_mdls.c path (Parse_lins). The vulnerability enables resource exhaustion/Denial of Service due to improper input validation. Exploitation requires user interaction; CVSSv3 indicates Network access with low complexity and UI-REQUIRED, with...

CVE-2020-0177

CVE-2020-0177 affects Android 10; the issue is described as a permissions bypass in PanService.java (connect()) that could allow local elevation of privilege to change network connection settings without extra privileges or user interaction. The connected Red Hat/Redacted entries and NVD details ...

CVE-2020-0185

CVE-2020-0185 affects Android 10, with the vulnerability in avrc_pars_browsing_cmd of avrc_pars_tg.cc. The root cause is a missing bounds check that enables an out-of-bounds read, leading to local information disclosure without extra privileges or user interaction. The issue is listed across mult...

CVE-2020-0186

The CVE-2020-0186 entry concerns an elevation-of-privilege flaw in Android 10 implemented in hal_fd_init (hal_fd.cc), caused by an incorrect bounds check that enables an out-of-bounds write. This could permit local escalation to system privileges with no user interaction required. The vulnerabili...

CVE-2020-0214

CVE-2020-0214 affects Android 10 and is caused by an out-of-bounds read in the function responsible for processing the file command (ce_t4t_process_select_file_cmd in ce_t4t.cc) due to an incorrect bounds check. The vulnerability allows remote information disclosure without requiring user interac...

CVE-2020-0307

CVE-2020-0307 affects Android 11, specifically a Settings component issue where an unsafe PendingIntent enables a local information disclosure without user interaction. Root cause is a permission bypass via PendingIntent; exploitation is local and does not require user interaction. The Android 11...

CVE-2020-0320

CVE-2020-0320 affects the Android library libstagefright and is described as a resource exhaustion vulnerability caused by improper input validation. This can lead to remote denial of service with no additional execution privileges required, with exploitation requiring user interaction. The issue...

CVE-2020-0332

CVE-2020-0332 affects Androids libstagefright with a dead loop caused by an uncaught exception, leading to remote denial of service. Exploitation requires user interaction; impact is a DoS with no extra privileges. The issue is cataloged under Android 11, and Android 11 security release notes ind...

CVE-2020-0355

CVE-2020-0355 affects libFraunhoferAAC in Android 11. It is an out-of-bounds read due to a missing bounds check, enabling remote information disclosure with no execution privileges. Exploitation requires user interaction. The issue is documented across multiple sources (NVD, RH, NCSC) and is list...

CVE-2020-0357

CVE-2020-0357 affects Android 11, specifically the SurfaceFlinger component. The issue is a use-after-free caused by improper locking, enabling local escalation of privilege in the graphics server without extra execution privileges or user interaction. Other documents confirm this CVE is addresse...

CVE-2020-0366

CVE-2020-0366 affects Android via a tapjacking-based permission bypass in PackageInstaller. The underlying issue can enable local escalation of privilege when an app is set as the default Assist app, with user interaction required for exploitation. Affected component: PackageInstaller; impact: el...

CVE-2020-0372

CVE-2020-0372 affects Android 11. In ActivityManager, a missing permission check enables local information disclosure of protected data without extra execution privileges. Impact is confined to information disclosure (confidentiality), with no user interaction required. The issue is addressed in ...

CVE-2020-0403

CVE-2020-0403 affects the FPC TrustZone fingerprint app and can enable local elevation of privilege in the TEE via an exposed test feature, requiring System-level privileges with no user interaction (per the NVD/Red Hat/PRION entries). The issue is categorized as Elevation of Privilege (EoP) affe...

CVE-2020-0406

CVE-2020-0406 affects Android 11 via the libmpeg2dec component. The issue is an out-of-bounds write caused by a missing bounds check in libmpeg2dec, enabling local privilege escalation if triggered with certain parameters; exploitation requires user interaction and does not require prior executio...

CVE-2020-0480

CVE-2020-0480 affects Android 11 in the Framework: DocumentsProvider.java allows a local escalation of privilege due to a missing permission check in callUnchecked. The issue enables a caller to copy, move, or delete files accessible to DocumentsProvider without extra execution privileges. Exploi...

CVE-2020-10838

Samsung mobile devices running P(9.0) and Q(10.0) are affected by CVE-2020-10838 in the PROCA component, which allows a use-after-free and arbitrary code execution. Samsung ID SVE-2019-16132 is referenced. Details indicate local exploitation with low prerequisites and high impact on confidentiali...

CVE-2020-10841

CVE-2020-10841 affects Samsung mobile devices with P(9.0)/Q(10.0) on Exynos 9610; root cause is an arbitrary kfree in the vipx and vertex drivers. Red Hat/NVD entries corroborate a kernel-free issue with potential high impact (CVE notes partial/confidentiality/availability risks, CVSSv3.1 base 7....

CVE-2020-25046

CVE-2020-25046 affects Samsung mobile devices running O(8.x), P(9.0), and Q(10.0). The issue is in the USB driver where address information is leaked via kernel logging. Root cause is the USB driver handling/logging that exposes kernel address data; impact reportedly includes partial confidential...

CVE-2020-27023

CVE-2020-27023 affects Android 11 where in BluetoothMediaBrowserService.java the setErrorPlaybackState path allows a permission bypass via an unsafe PendingIntent. This could lead to local information disclosure with System-level privileges (no user interaction required per the report). CVSS metr...

CVE-2020-27037

CVE-2020-27037 affects Android 11, with a vulnerability in phNxpNciHal_core_initialized of phNxpNciHal.cc that can trigger an out-of-bounds read due to a missing bounds check. This could lead to local information disclosure on the NFC server and may grant System execution privileges, with no user...

CVE-2020-27039

CVE-2020-27039 : A flaw in Android 11 related to postNotification in ServiceRecord.java enables a local permission bypass via an unsafe PendingIntent. This could lead to local information disclosure with low to medium risk (CVSSv3.1 base score 5.5; LOCAL, NONE user interaction). Exploitation is d...

CVE-2021-0409

CVE-2021-0409 affects the MediaTek flv extractor, where an out-of-bounds read can occur due to an incorrect bounds check. This may lead to local information disclosure without requiring user interaction. The issue is documented with patch ID ALPS05561359 / Issue ID ALPS05561359. Connected sources...

CVE-2021-0411

CVE-2021-0411 affects the MediaTek flv extractor. The vulnerability is an out-of-bounds read caused by an integer overflow in the component, enabling local information disclosure without additional execution privileges or user interaction. Mitigation/patch reference: ALPS05561362 (Issue ID ALPS05...

CVE-2021-0424

The CVE-2021-0424 entry concerns a Mediatek device where the in memory management driver has a missing bounds check, enabling a local denial-of-service due to a system crash. Exploitation requires local access with no user interaction. The patch reference is ALPS05403499 (Issue ALPS05393787). Con...

CVE-2021-0425

CVE-2021-0425 relates to a side-channel information disclosure in the memory management driver, enabling local information disclosure without user interaction. The vulnerability affects the memory-management component and is tied to the Mediatek ecosystem per linked advisories. The root cause is ...

CVE-2021-0465

CVE-2021-0465 affects the Android kernel component used by Pixel devices, specifically the GenerateFaceMask function in face.cc. The issue is an out-of-bounds write caused by an incorrect bounds check, enabling local escalation of privilege with no extra execution privileges required and no user ...

CVE-2021-0634

CVE-2021-0634 affects MediaTek’s display driver; vulnerability arises from memory corruption due to uninitialized data, enabling local privilege escalation to SYSTEM with no user interaction. Connected sources (Red Hat, NVD, CVE records) confirm the issue and reference patch ALPS05594994 (Issue A...

CVE-2021-23243

Technical details are not publicly available in the provided documents. Information on affected products, versions, impact or remediation is not specified. Monitor for updates.

CVE-2021-25407

Summary (CVE-2021-25407) : A vulnerability in Samsung’s NPU driver (pre-SMR JUN-2021 Release 1) enables an out-of-bounds write, allowing arbitrary memory writes. The issue is rooted in the NPU driver and affects devices using the affected firmware. Publicly disclosed data indicate potential impac...

CVE-2021-25467

CVE-2021-25467 describes a potential buffer overflow in the Vision DSP kernel driver (Samsung devices) before SMR Oct-2021 Release 1, enabling privilege escalation to root via hijacking a loaded library. The incident is tied to local exploit scenarios, with impact described as high for confidenti...

CVE-2021-25483

Summary of CVE-2021-25483 (livfivextractor) : The vulnerability affects the livfivextractor library prior to Samsung SMR Oct-2021 Release 1, due to a lack of boundary checking in a buffer which allows an out-of-bounds read. Reported across multiple feeds (NVD, Red Hat advisory, CVE lists, and CNN...

CVE-2021-25491

CVE-2021-25491 affects the Samsung mfc driver. The root cause is a NULL-pointer dereference that can cause memory corruption in versions prior to Samsung SMR Oct-2021 Release 1. Public data indicates impact on memory handling, with CVSS details showing low to medium base severity depending on met...

CVE-2022-47353

CVE-2022-47353 affects the vdsp device. The root cause is improper input validation that can cause a system crash, leading to local denial of service with system execution privileges. Documents describe this as a local issue with high availability impact; there is no publicly available exploit in...

CVE-2022-47491

CVE-2022-47491 concerns the UNISOC-soter service, where a missing bounds check enables an out-of-bounds write. This could yield local denial of service with execution privileges required. The NVD notes a CVSS v3.1 base score of 4.4 (MEDIUM); attack vector LOCAL, privilege requirement HIGH, and av...

CVE-2022-48442

CVE-2022-48442 affects the dialer service with a missing permission check, enabling local denial of service with no extra privileges. The connected sources consistently describe this impact, but do not provide concrete exploit details or remediation (no patch/version information is present in the...

CVE-2022-48447

CVE-2022-48447 affects the telephony service. The root cause is a missing permission check, which could allow a local attacker to cause a denial of service with no additional execution privileges. The available documents describe the vulnerability and its impact but do not specify a patch/version...

CVE-2023-20681

CVE-2023-20681 affects adsp with a possible out-of-bounds write due to improper input validation, enabling local escalation of privilege with SYSTEM privileges. Exploitation requires no user interaction; no public exploit details are provided in the connected documents. Patch ALPS07696134 (Issue ...

CVE-2023-20772

CVE-2023-20772 affects the vow component, where a missing permission check enables local escalation of privilege without requiring user interaction. The issue can be exploited locally to gain higher privileges, as indicated by the CVSS data (LOCAL vector, high confidentiality/integrity/availabili...

CVE-2023-20784

CVE-2023-20784 describes an out-of-bounds write in the keyinstall component due to a missing bounds check, enabling local escalation of privilege with SYSTEM execution privileges required and no user interaction. The vulnerability is associated with MediaTek-based chip environments as per multipl...

CVE-2023-20814

The CVE-2023-20814 issue is described as an out-of-bounds write in the MediaTek WLAN service caused by improper input validation, enabling local escalation to SYSTEM with no user interaction. Affected software is MediaTek WLAN components; root cause is a buffer/bounds check failure. Impact is loc...

CVE-2023-21308

CVE-2023-21308 : In Composer, a missing bounds check allows an out-of-bounds read which could enable local escalation of privilege without user interaction. Exploitation details/affected versions are not disclosed in the provided documents. No patch/remediation information is included here. If ex...

CVE-2023-30917

CVE-2023-30917 affects DMService in Unisoc chipsets (e.g., SC9863A, SC9832E, SC7731E, T610, T310, T606, T760, T618, etc.) due to a missing permission check, enabling local privilege escalation with no additional privileges. NVD data shows CVSS v3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (base...

CVE-2023-30919

The CVE-2023-30919 vulnerability is due to a missing permission check in the messaging service, enabling local information disclosure without requiring additional execution privileges. Public records (NVD, Red Hat, PRION, CVE listing) describe the issue as a local-privilege-context information ex...

CVE-2023-30922

CVE-2023-30922 describes a missing permission check in the messaging service, leading to local information disclosure without extra execution privileges. The vulnerability is reported across multiple sources tied to UNISOC chipsets (e.g., SC9863A, SC9832E, SC7731E, T610, T310, T606, T760, T618, T...

CVE-2023-30924

CVE-2023-30924 involves a missing permission check in the messaging service, enabling local information disclosure without extra execution privileges. The NVD entry assigns CVSS v3.1 base score 5.5 (Local, Low attack complexity, Privileges Required: Low, Confidentiality Impact: High) and notes it...

CVE-2023-30925

CVE-2023-30925 describes a missing permission check in the opm service that can cause local information disclosure without requiring extra privileges. Multiple sources (including NVD and Red Hat) confirm the issue and its impact, with a CVSSv3.1 base score of 5.5 (Local access, Confidentiality im...

CVE-2023-30941

CVE-2023-30941 concerns a missing permission check in the telephony service that can lead to local information disclosure without requiring additional execution privileges. The available documents describe the vulnerability as a local information disclosure flaw (CONFIDENTIALITY impact) with priv...

CVE-2023-32788

The CVE-2023-32788 entry concerns a missing permission check in the telephony service that could lead to local information disclosure without additional execution privileges. Affected scope is described across multiple sources (NVD/Red Hat/CVE record), with the CVSS v3.1 vector indicating Local a...