8153 matches found
CVE-2023-35669
CVE-2023-35669 affects the Android Framework (AccountManagerService.java). The issue stems from unsafe deserialization in checkKeyIntentParceledCorrectly, enabling local elevation of privilege by an attacker with local access and no user interaction. The NVD entry lists local access, low attack c...
CVE-2016-0821
The CVE-2016-0821 issue relates to the LIST_POISON protection in the Linux kernel (include/linux/poison.h) prior to version 4.3. It affected Android 6.0.1 prior to 2016-03-01 and arises because poison values were used without properly accounting for mmap_min_addr, enabling bypass of poison-pointe...
CVE-2017-13322
CVE-2017-13322 is an Android DoS vulnerability in the system component (PhoneInterfaceManager.java) due to a logic error in endCallForSubscriber that can prevent emergency services access locally, with no user interaction required. Affected: Google Pixel/Nexus devices (Android framework/system). ...
CVE-2020-0076
CVE-2020-0076 affects the FPC Iris TZ App in Android. Description: an out-of-bounds write in get_auth_result due to a missing bounds check, enabling local elevation of privilege to System if exploited; exploitation does not require user interaction. Affected product/area: Android kernel component...
CVE-2021-0313
CVE-2021-0313 affects Android’s Framework component (isWordBreakAfter in LayoutUtils.cpp). The issue describes a vulnerability where improper input validation can slow or crash a TextView, potentially enabling remote denial of service without user interaction. Affected Android versions include 8....
CVE-2022-20131
CVE-2022-20131 affects Android (10–12/12L) with a root cause in nci_proc_rf_management_ntf of nci_hrcv.cc, causing an out-of-bounds read that can disclose information remotely without user interaction. The issue is linked to the Android RF management notification path and is mapped to a System/ID...
CVE-2022-20469
CVE-2022-20469 affects Android Bluetooth stack. The vulnerability is an out-of-bounds write in avct_lcb_msg_asmbl (avct_lcb_act.cc), caused by a missing bounds check, enabling local privilege escalation over Bluetooth without user interaction. Affected versions include Android-10, Android-11, And...
CVE-2022-20471
CVE-2022-20471 involves an out-of-bounds read in SendIncDecRestoreCmdPart2 of NxpMfcReader.cc due to a missing bounds check. This can lead to local information disclosure on affected Android versions (Android 11–13). The issue does not require user interaction and does not grant remote code execu...
CVE-2022-20483
CVE-2022-20483 affects Android devices (Android 10–13 per the bulletin). Root cause: out-of-bounds reads caused by integer overflows in avrc_pars_ct.cc when parsing avrc responses. Impact: remote information disclosure without authentication or user interaction. Exploitation details are not provi...
CVE-2023-20948
CVE-2023-20948 affects Android (Android-12/12L/13) with a flaw in AAVCAssembler.cpp: in dropFramesUntilIframe there is a possible out-of-bounds read caused by a heap buffer overflow, leading to remote information disclosure without extra privileges or user interaction. Connections show no publish...
CVE-2023-20955
CVE-2023-20955 affects Android 11–13 and is triggered in the app component AppInfoDashboardFragment.java, in onPrepareOptionsMenu, due to a missing permission check. This enables local privilege escalation to uninstall apps for all users without user interaction. Conditions described in the linke...
CVE-2023-21126
CVE-2023-21126 affects Android 13. The issue arises in MediaControlPanel.java’s bindOutputSwitcherAndBroadcastButton, where an Unsafe Intent can launch an arbitrary activity under SysUI. This enables local elevation of privilege with no required user interaction. The vulnerability is supported by...
CVE-2023-21290
CVE-2023-21290 affects Google Android (MmsProvider.java) and is due to a race condition that can bypass file permission checks. This enables local denial of service with no additional execution privileges and requires no user interaction to exploit. Public references indicate Android security bul...
CVE-2023-45777
CVE-2023-45777 affects Android’s AccountManagerService (checkKeyIntentParceledCorrectly) where a Parcel Mismatch could let an attacker launch arbitrary activities with system privileges, causing local elevation of privilege. Public details consistently describe this as a local, no-auth vulnerabil...
CVE-2021-0588
CVE-2021-0588 describes an information-disclosure flaw in Android’s System component where processInboundMessage in MceStateMachine.java can disclose SMS-related data due to a missing permission check. Exploitation is local (no user interaction required) and could occur on affected versions (Andr...
CVE-2021-0695
CVE-2021-0695 is a vulnerability in the Android kernel (xt_qtaguid.c: get_sock_stat) caused by a use-after-free that enables an out-of-bounds read leading to local information disclosure. Exploitation is local (no user interaction required) per the description; impact is partial confidentiality. ...
CVE-2022-20026
CVE-2022-20026 concerns a Bluetooth out-of-bounds write caused by a missing bounds check. Exploitation would enable local escalation of privilege with no user interaction required, per the provided entries (NVD/Red Hat/PRION variants). The issue is linked to a MediaTek ALPS06126827 patch/ID and i...
CVE-2022-20238
CVE-2022-20238 describes a kernel memory mapping flaw in Android where remap_pfn_range can map memory outside the intended region because vma->vm_page_prot is user-controllable. The result is a potential writable mapping of kernel memory, enabling exploitation per several sources (Android kern...
CVE-2022-20239
CVE-2022-20239 is an Android kernel vulnerability inherited from a memory-mapping flaw in remap_pfn_range that can let userspace map the kernel area as writable. Documents consistently describe the issue as kernel memory mapping in remap_pfn_range, with potential for local/remote-like impact depe...
CVE-2022-23431
CVE-2022-23431 involves an improper boundary check in the RPMB ldfw component prior to SMR Feb-2022 Release 1, as described across multiple sources. The vulnerability allows arbitrary memory write and code execution. Relevant entries from NVD/Red Hat/NCSC-style advisories consistently reference t...
CVE-2023-20911
CVE-2023-20911 affects Google's Android platform (Android 11–13) and centers on the addPermission path in PermissionManagerServiceImpl.java. The root cause is a risk of failing to persist permission settings due to resource exhaustion, which could enable local elevation of privilege without requi...
CVE-2023-21121
CVE-2023-21121 affects Android 11–12 and concerns an input validation issue in the onResume method of AppManagementFragment.java. The underlying problem could allow local elevation of privilege without additional execution privileges or user interaction. Exploitation is described as local (attack...
CVE-2023-21140
CVE-2023-21140 affects Android’s ManagePermissionsActivity.java. The root cause is a missing permission check in onCreate, allowing a local attacker with physical access to bypass factory reset protections and escalate privileges without any user interaction. Impact is described as local EoP with...
CVE-2023-21289
CVE-2023-21289 affects Google Android and is an information-disclosure issue caused by a confused-deputy bypass of a multi-user security boundary. The description in connected records indicates local information disclosure with no extra privileges and no user interaction required. Public referenc...
CVE-2024-43763
CVE-2024-43763 affects Google Android: in build_read_multi_rsp of gatt_sr.cc a logic error can cause remote DoS without user interaction. Impact is denial of service; no exploit details provided here. Remediation is through Android security patches at the 2025-01-01 (and newer) patch level as doc...
CVE-2019-2103
CVE-2019-2103 affects Android 9 Framework. It describes a permissions bypass that could allow the Google Assistant to screenshot FLAG_SECURE apps, leading to local information disclosure without user interaction. The Android Security Bulletin lists CVE-2019-2103 under Framework with Type ID and H...
CVE-2020-0071
CVE-2020-0071 affects Android System component on Android 8.0–10. The vulnerability occurs in rw_t2t_extract_default_locks_info (rw_t2t_ndef.cc), where a missing bounds check can cause an out-of-bounds write, enabling remote code execution over NFC without user interaction. Affected products/vers...
CVE-2020-0078
CVE-2020-0078 : In the Android Media framework, the function releaseSecureStops in DrmPlugin.cpp contains an out-of-bounds write due to a missing bounds check. This leads to local escalation of privilege with no additional execution privileges or user interaction required. Affected: Android 9 and...
CVE-2021-0310
CVE-2021-0310 affects Android 11 in the LazyServiceRegistrar component. The connected documents describe a memory corruption issue caused by a use-after-free in LazyServiceRegistrar.cpp, enabling local escalation of privilege with no additional execution privileges required and no user interactio...
CVE-2021-0475
CVE-2021-0475 is documented across multiple sources as a remote code execution (RCE) vulnerability in the Android System component, impacting Android 10 and 11 with fixes delivered for patch levels 10 and 11. The NVD entry describes a use-after-free memory corruption in Bluetooth (btif_sock_l2cap...
CVE-2021-0889
The CVE-2021-0889 entry concerns Android TV Remote Service where a silent pairing due to no rate-limiting in the pairing flow can enable remote code execution without user interaction. Affected products include Android TV on Android 8.1, 9, 10, 11, and 12. The root cause cited is lack of rate lim...
CVE-2022-20166
CVE-2022-20166 refers to a heap-based out-of-bounds write in multiple Android kernel base drivers that can enable local privilege escalation to SYSTEM. The issue requires no user interaction to exploit and is exploited via heap buffer overflow in kernel base drivers, granting local code execution...
CVE-2022-20470
CVE-2022-20470 affects Android where bindRemoteViewsService in AppWidgetServiceImpl.java can bypass background activity launch due to improper input validation, enabling local elevation of privilege without extra privileges. Affected: Android 10–13 (per README). Connected documents corroborate th...
CVE-2022-20475
CVE-2022-20475 is an Elevation of Privilege vulnerability in Android (affecting Android-11 through Android-13) tied to ResetTargetTaskHelper.java tests. It enables hijacking of apps that set allowTaskReparenting="true" via a confused deputy, leading to local privilege escalation with no additiona...
CVE-2022-20568
CVE-2022-20568 describes a use-after-free in the Android kernel that could corrupt kernel memory and enable local escalation of privileges without user interaction; exploitation is reported as local, with no additional privileges or interaction required. The connected security bulletins (EulerOS/...
CVE-2022-30711
The CVE-2022-30711 entry describes an improper validation vulnerability in Samsung Mobile FeedsInfo prior to SMR Jun-2022 Release 1. The issue, caused by insufficient input validation in FeedsInfo, can allow an attacker to launch certain activities. Affected product/component: Samsung Mobile Feed...
CVE-2024-31331
CVE-2024-31331 affects the Android Framework, specifically a logic error in PackageManagerService.java setMimeGroup that can hide the service from Settings. This can enable local elevation of privilege with high impact (confidentiality/integrity/availability). Exploitation requires local access a...
CVE-2024-34743
CVE-2024-34743 affects Google Android via a logic error in SurfaceFlinger.cpp (setTransactionState) that could enable tapjacking, leading to local elevation of privilege with no user interaction required. The vulnerability is classified as EoP, High severity, with local attack vector and impact t...
CVE-2017-13151
CVE-2017-13151 is a remote code execution in Android’s Media framework (libmpeg2) affecting Android 6.0–8.0. The Android Security Bulletin (Dec 2017) classifies the Media framework vulnerability as critical (RCE) and links to patches in the 2017-12-01/2017-12-05 update levels. Affected codecs inc...
CVE-2021-0311
CVE-2021-0311 is a real Android vulnerability describing an out-of-bounds write in ElementaryStreamQueue::dequeueAccessUnitH264() (ESQueue.cpp) that could lead to remote information disclosure. Affects Android 8.0–11; exploitation requires user interaction. The issue is categorized as ID in the A...
CVE-2021-0336
CVE-2021-0336 (Android) affects Android 8.1–11. Root cause: a vulnerability in onReceive of BluetoothPermissionRequest.java allows a permissions bypass via a mutable PendingIntent, enabling local escalation of privilege by bypassing a permission check. Exploitation is described as requiring only ...
CVE-2021-0934
Summary: CVE-2021-0934 is a DoS in Android: in the function findAllDeAccounts of AccountsDb.java, causing resource exhaustion and local denial of service without extra privileges or user interaction. Affected products/versions include Android 10–13. The vulnerability’s impact is DoS; no exploit d...
CVE-2022-20235
CVE-2022-20235 describes a memory corruption risk in the PowerVR GPU kernel driver for Android SoCs caused by a flaw in the Information Page of the driver’s cache subsystem. Prior to DDK 1.18, a user-space process could write arbitrary data to that page (the page is normally writable only by the ...
CVE-2022-20349
CVE-2022-20349 affects Android 10–12(12L) and concerns the WifiScanningPreferenceController and BluetoothScanningPreferenceController. The issue is a possible admin restriction bypass caused by a missing permission check, enabling local elevation of privilege with no additional execution privileg...
CVE-2022-20426
CVE-2022-20426 affects Android 10–13, with a DoS condition caused by resource exhaustion in multiple functions across many files that can block a user from selecting a phone account. The impact is local denial of service with no privileges or user interaction required. The vulnerability is docume...
CVE-2022-21768
The CVE-2022-21768 entry corresponds to a Bluetooth buffer overflow (out-of-bounds write) caused by a missing bounds check, enabling local elevation of privilege with no user interaction. Public documents reference a patch ID ALPS06784351/ALPS06784351 and indicate this affects MediaTek Bluetooth ...
CVE-2023-20935
CVE-2023-20935 affects Android 11–13. It describes an out-of-bounds read caused by a missing bounds check during deserialization of multiple files, leading to local information disclosure without needing user interaction. Root cause: bounds-check omission in the deserialize path of the multiple f...
CVE-2023-21135
CVE-2023-21135 affects Google Android: the issue occurs in the onCreate path of NotificationAccessSettings.java, where improper input validation can cause a failure to persist notification settings. The underlying problem is an input validation defect in the code path that manages notification ac...
CVE-2024-23712
CVE-2024-23712 affects Android’s AppOpsService.java. It describes a potential DoS by saturating /data/system/appops_accesses.xml due to resource exhaustion. Exploitation is local with no privileges and no user interaction required. Android bulletin context indicates fixes in patch levels 2024-04-...