CVE-2019-20598

The CVE-2019-20598 entry concerns Samsung mobile devices running O(8.x) software where Bixby can leak the keyboard’s learned words and clipboard contents through the lock screen. The vulnerability is documented with Samsung IDs SVE-2018-12896 and SVE-2018-12897. Connected records (e.g., Red Hat C...

CVE-2019-2087

CVE-2019-2087 affects Android 10 libxaac. Root cause: out-of-bounds write from a missing bounds check, enabling remote code execution with no privileges and requiring user interaction. Mitigation: apply patches as part of Android 10 updates; devices with a security patch level of 2019-09-01 or la...

CVE-2019-2141

The CVE-2019-2141 issue affects Android 10, specifically the libxaac library. The root cause is an out-of-bounds write due to a missing bounds check in libxaac, which could enable remote code execution. The vulnerability is described as requiring user interaction for exploitation and having poten...

CVE-2019-2151

CVE-2019-2151 is an information-disclosure flaw in libxaac on Android 10 caused by an out-of-bounds read due to a missing bounds check. The Red Hat and CNVD references confirm the same description and indicate Android-10 as affected. There is no explicit indication of an available patch/version i...

CVE-2019-2152

CVE-2019-2152 affects libxaac in Android 10 (Android-10). The issue is an out-of-bounds read caused by a missing bounds check, which could lead to information disclosure without requiring additional execution privileges. Exploitation requires user interaction. The CVE is listed in the Android 10 ...

CVE-2019-9279

CVE-2019-9279 maps to Android 10’s wifi hotspot service vulnerability: a null pointer dereference causes a remote DoS without user interaction. Affected component is the wifi hotspot service in Android 10; exploitation results in denial of service (availability impact) with network access as the ...

CVE-2019-9323

CVE-2019-9323 affects the Android Wallpaper Manager service. The issue is an information disclosure caused by a missing permission check, allowing any application to access the wallpaper image without extra privileges, with no user interaction required. The Android 10 release notes indicate this ...

CVE-2019-9333

CVE-2019-9333 affects Android 10 Bluetooth. Root cause: a missing bounds check causes an out-of-bounds read, enabling remote information disclosure without additional execution privileges and without user interaction. CVSS metrics show network attack with low complexity (CVSSv3.1: AV:N/AC:L/PR:N/...

CVE-2019-9357

CVE-2019-9357 affects libAACdec in Android 10’s Media Framework. An integer overflow can trigger an out-of-bounds write, enabling remote code execution. Exploitation requires user interaction; no privileges beyond the user. Android 10 patch level 2019-09-01 or later mitigates via released securit...

CVE-2019-9361

The CVE-2019-9361 entry concerns Android 10’s libavc (media framework) with an information-disclosure flaw caused by uninitialized data. Affected component: libavc in Android 10 (Android-10). Impact: potential remote information disclosure without executing code; exploitation requires user intera...

CVE-2019-9362

CVE-2019-9362 affects the Android 10 libSACdec component, where a missing bounds check can cause an out-of-bounds read and potential information disclosure. The issue is described as a remote information disclosure vulnerability with user interaction required for exploitation; no exploitation det...

CVE-2019-9378

CVE-2019-9378 affects Android 10 in the Framework/Activity Manager area, where a permission check weakness allows local elevation of privileges without user interaction. The issue enables a bypass of access controls to gain higher privileges on the device, with Local attack vector and no authenti...

CVE-2019-9440

CVE-2019-9440 is an information-disclosure vulnerability in AOSP Email on Android 10 caused by a confused deputy, enabling local disclosure of the Email app’s protected files. Exploitation requires user interaction. Affected software: AOSP Email component on Android-10. Root cause: improper acces...

CVE-2020-0042

The CVE-2020-0042 issue affects the FPC Fingerprint TEE in Android’s fpc_ta_hw_auth_qsee.c. The root cause is a missing bounds check that enables an out-of-bounds read. This could allow local information disclosure and requires system privileges if exploited, with no user interaction needed. Expl...

CVE-2020-0061

CVE-2020-0061 pertains to Pixel Recorder on Android, where a permissions bypass can allow arbitrary apps to record audio, leading to local information disclosure without extra execution privileges. The vulnerability affects the Android System component as listed in the Pixel Update Bulletin (Syst...

CVE-2020-0139

CVE-2020-0139 affects Android 10. The vulnerability is a flaw in NDEF_MsgValidate (ndef_utils.c) where an integer overflow can cause an out-of-bounds read, potentially enabling local information disclosure when a malformed NFC tag is processed by the firmware. Exploitation is described as requiri...

CVE-2020-0142

CVE-2020-0142 describes an information disclosure in Android's rw_i93_sm_format (rw_i93.c) caused by a missing bounds check. The issue allows remote information disclosure with network access and no user interaction. Affected software is Android 10 (as per the CVE entry). The CVSS data provided s...

CVE-2020-0157

CVE-2020-0157: A out-of-bounds read vulnerability in Android's nfa_hci_main.cc (function nfa_hci_conn_cback) could enable remote information disclosure from compromised device firmware. Reported for Android 10; CVSS/EXPL provides network attack vector with low complexity and no user interaction p...

CVE-2020-0165

CVE-2020-0165 affects Android 10. The issue is a potential out-of-bounds write in phNxpNciHal_NfcDep_cmd_ext (nfc driver code), caused by a missing bounds check, enabling local escalation of privilege with System execution privileges; no user interaction required. CVSSv3.1 base score 6.7 (Local, ...

CVE-2020-0177

CVE-2020-0177 affects Android 10; the issue is described as a permissions bypass in PanService.java (connect()) that could allow local elevation of privilege to change network connection settings without extra privileges or user interaction. The connected Red Hat/Redacted entries and NVD details ...

CVE-2020-0192

CVE-2020-0192 affects Android 10 in the Media Framework. The issue is an out-of-bounds read in ih264d_decode_slice_thread (ih264d_thread_parse_decode.c) caused by improper input validation, enabling remote information disclosure with user interaction required for exploitation. Public references i...

CVE-2020-0274

The CVE-2020-0274 issue affects the Android 11 OMX parser, where a returned raw pointer can cause local information disclosure without requiring user interaction. This is described across multiple sources (NVD/Red Hat/CNVD entries) as an information-disclosure vulnerability tied to the OMX parser...

CVE-2020-0287

The CVE-2020-0287 issue affects libmkvextractor in Android 11. The vulnerability is a resource exhaustion (Denial of Service) caused by a missing bounds check in a component handling MKV extraction. It can be exploited remotely with network access, but requires user interaction to trigger the fla...

CVE-2020-0300

CVE-2020-0300 affects Android 11 NFC handling, where an out-of-bounds read from uninitialized data can lead to remote information disclosure without user interaction. The NVD CVSSv3.1 base score is 7.5 (High) with network attack vector and no privileges required; CVSSv2 base score 5.0 (Medium). A...

CVE-2020-0301

CVE-2020-0301 affects Android 11 and is tied to libstagefright, where improper input validation can cause resource exhaustion and remote denial of service. The vulnerability supports a DoS condition without additional privileges; exploitation requires user interaction. The CVE is documented in NV...

CVE-2020-0357

CVE-2020-0357 affects Android 11, specifically the SurfaceFlinger component. The issue is a use-after-free caused by improper locking, enabling local escalation of privilege in the graphics server without extra execution privileges or user interaction. Other documents confirm this CVE is addresse...

CVE-2020-0359

CVE-2020-0359 affects the Android GLESRenderEngine on Android 11, where an out-of-bounds read caused by a buffer overflow could enable local information disclosure without user interaction. The issue is described as a local vulnerability with no execution privileges required and no interaction ne...

CVE-2020-0366

CVE-2020-0366 affects Android via a tapjacking-based permission bypass in PackageInstaller. The underlying issue can enable local escalation of privilege when an app is set as the default Assist app, with user interaction required for exploitation. Affected component: PackageInstaller; impact: el...

CVE-2020-0403

CVE-2020-0403 affects the FPC TrustZone fingerprint app and can enable local elevation of privilege in the TEE via an exposed test feature, requiring System-level privileges with no user interaction (per the NVD/Red Hat/PRION entries). The issue is categorized as Elevation of Privilege (EoP) affe...

CVE-2020-0479

The CVE-2020-0479 issue affects Android 11 and is described as a permissions bypass in DocumentsProvider.java (callUnchecked), enabling a malicious app to access files managed by a DocumentProvider without user permission. Exploitation requires user interaction, and the vulnerability allows local...

CVE-2020-0491

CVE-2020-0491 affects Android 11 on Pixel devices. The issue is in readBlock of MatroskaExtractor.cpp, where resource exhaustion can cause a denial of service. This can enable remote DoS with user interaction required for exploitation. Exploitation details, affected build patches, and concrete re...

CVE-2020-10839

CVE-2020-10839 affects Samsung mobile devices running Android O (8.x), P (9.0), and Q (10.0), where attackers can bypass Factory Reset Protection (FRP) via a SIM card. The vulnerability is associated with Samsung ID SVE-2019-16193 (Feb 2020). Public references in connected sources reiterate the F...

CVE-2020-10842

The CVE-2020-10842 issue affects Samsung mobile devices on O(8.x), P(9.0), and Q(10.0) using S.LSI chipsets. A heap out-of-bounds write in the tsmux driver is identified as the root cause. Impact is described in CVSS terms as high for confidentiality, integrity, and availability (local exploit, l...

CVE-2020-10852

CVE-2020-10852 involves a stack overflow in the display driver affecting Samsung mobile devices running O(8.x), P(9.0), and Q(10.0) software (Samsung ID SVE-2019-15877). The Red Hat/EUVD/CNVD entries corroborate the same issue. According to the NVD metrics, CVSS v3.1 base score is 7.8 (HIGH) with...

CVE-2020-25049

CVE-2020-25049 affects Samsung mobile devices running P (9.0) and Q (10.0) software, where the StatusBarService has insufficient DEX access control. The vulnerability is documented by NVD as having a high base score (CVSS v3.1: 9.8, NETWORK, NONE user interaction, HIGH confidentiality/integrity/a...

CVE-2020-27026

CVE-2020-27026 affects Android 11 devices (as described: Android-11) where the lock screen/unlock interface during boot behaves differently depending on whether a fingerprint is registered. This can lead to local information disclosure without additional execution privileges. The vulnerability is...

CVE-2020-27030

CVE-2020-27030 (Android 11) describes a permission bypass caused by a flaw in HandleApiCalls.java during onCreate, enabling local escalation of privilege via a confused deputy. This could let an app set or dismiss alarms without additional privileges, with no user interaction required. Exploitati...

CVE-2020-27041

In CVE-2020-27041, the issue is in Android 11’s ConnectivityService.java showProvisioningNotification where an unsafe PendingIntent could allow local information disclosure of notification data without extra privileges or user interaction. The vulnerability is a local disclosure due to PendingInt...

CVE-2020-27056

CVE-2020-27056 affects Android 11 with a missing permission check in SELinux MLS policies that can disclose local package-metadata information without extra privileges. The issue is confirmed as a local information-disclosure vulnerability; no exploitation details are provided in the documents. R...

CVE-2021-0415

CVE-2021-0415 concerns a vulnerability in the Mediatek memory management driver where a missing permission check can disclose local information without requiring user interaction. The issue affects the in-memory management component (Mediatek chipset context) and enables information leakage with ...

CVE-2021-0455

The CVE-2021-0455 issue is described as an out-of-bounds write in the Citadel chip firmware, caused by a missing bounds check. It grants local elevation of privilege with System execution privileges required, and requires no user interaction to exploit. In the provided materials, the vulnerabilit...

CVE-2021-0629

The CVE-2021-0629 entry centers on the mdlactl driver, where a use-after-free leads to memory corruption and local privilege escalation, requiring System privileges but no user interaction. Multiple connected records corroborate the issue and cite patch ALPS05776625 (Issue ID ALPS05776625) as the...

CVE-2021-0659

The CVE-2021-0659 entry concerns the apusys component where an out-of-bounds read can occur due to an incorrect bounds check. This may lead to local information disclosure and requires system privileges for impact; exploitation does not require user interaction. Affected context is supported by c...

CVE-2021-25384

CVE-2021-25384 describes an improper input validation in the Samsung libsdffextractor library, specifically in the function handling the Sample Rate Chunk (sdfffd_parse_chunk_PROP). The vulnerability, affecting versions prior to SMR MAY-2021 Release 1, can allow an attacker to trigger arbitrary c...

CVE-2021-25407

Summary (CVE-2021-25407) : A vulnerability in Samsung’s NPU driver (pre-SMR JUN-2021 Release 1) enables an out-of-bounds write, allowing arbitrary memory writes. The issue is rooted in the NPU driver and affects devices using the affected firmware. Publicly disclosed data indicate potential impac...

CVE-2021-25412

The CVE-2021-25412 entry concerns an improper access control flaw in genericssoservice before Samsung SMR JUN-2021 Release 1. The vulnerability enables local attackers to perform protected activities with system privileges via untrusted applications, due to insufficient access restrictions on sen...

CVE-2022-30757

CVE-2022-30757 concerns the Samsung isemtelephony component. The available disclosures state an improper authorization flaw that lets an attacker obtain the device CID without the ACCESS_FINE_LOCATION permission, affecting versions before the Samsung SMR Jul-2022 Release 1. Public sources consist...

CVE-2022-38685

CVE-2022-38685 affects UNISOC chipsets’ Bluetooth service module, where a missing privilege check in the Bluetooth service could allow local denial of service without extra execution privileges. The issue is documented across multiple sources (NVD/NVD mirror and related catalogs) with this root c...

CVE-2022-47491

CVE-2022-47491 concerns the UNISOC-soter service, where a missing bounds check enables an out-of-bounds write. This could yield local denial of service with execution privileges required. The NVD notes a CVSS v3.1 base score of 4.4 (MEDIUM); attack vector LOCAL, privilege requirement HIGH, and av...

CVE-2023-20772

CVE-2023-20772 affects the vow component, where a missing permission check enables local escalation of privilege without requiring user interaction. The issue can be exploited locally to gain higher privileges, as indicated by the CVSS data (LOCAL vector, high confidentiality/integrity/availabili...