CVE-2020-0324

Summary: CVE-2020-0324 affects Android 11 via the libsonivox component, where a missing bounds check can cause an out-of-bounds read. This leads to potential remote information disclosure without execution privileges, with user interaction required to exploit. Evidence from provided documents: Th...

CVE-2020-0332

CVE-2020-0332 affects Androids libstagefright with a dead loop caused by an uncaught exception, leading to remote denial of service. Exploitation requires user interaction; impact is a DoS with no extra privileges. The issue is cataloged under Android 11, and Android 11 security release notes ind...

CVE-2020-0341

CVE-2020-0341 affects Android 11; a missing permission check in DisplayManager may allow local escalation of privilege without user interaction. The issue is categorized as Elevation of Privilege (EoP). No exploit details are provided in the sources. Remediation: Android 11 security release notes...

CVE-2020-0357

CVE-2020-0357 affects Android 11, specifically the SurfaceFlinger component. The issue is a use-after-free caused by improper locking, enabling local escalation of privilege in the graphics server without extra execution privileges or user interaction. Other documents confirm this CVE is addresse...

CVE-2020-0366

CVE-2020-0366 affects Android via a tapjacking-based permission bypass in PackageInstaller. The underlying issue can enable local escalation of privilege when an app is set as the default Assist app, with user interaction required for exploitation. Affected component: PackageInstaller; impact: el...

CVE-2020-0479

The CVE-2020-0479 issue affects Android 11 and is described as a permissions bypass in DocumentsProvider.java (callUnchecked), enabling a malicious app to access files managed by a DocumentProvider without user permission. Exploitation requires user interaction, and the vulnerability allows local...

CVE-2020-10838

Samsung mobile devices running P(9.0) and Q(10.0) are affected by CVE-2020-10838 in the PROCA component, which allows a use-after-free and arbitrary code execution. Samsung ID SVE-2019-16132 is referenced. Details indicate local exploitation with low prerequisites and high impact on confidentiali...

CVE-2020-10839

CVE-2020-10839 affects Samsung mobile devices running Android O (8.x), P (9.0), and Q (10.0), where attackers can bypass Factory Reset Protection (FRP) via a SIM card. The vulnerability is associated with Samsung ID SVE-2019-16193 (Feb 2020). Public references in connected sources reiterate the F...

CVE-2020-10842

The CVE-2020-10842 issue affects Samsung mobile devices on O(8.x), P(9.0), and Q(10.0) using S.LSI chipsets. A heap out-of-bounds write in the tsmux driver is identified as the root cause. Impact is described in CVSS terms as high for confidentiality, integrity, and availability (local exploit, l...

CVE-2020-10847

CVE-2020-10847 affects Samsung mobile devices running P(9.0) on Galaxy S8 and Note8, where the facial recognition system can be spoofed. The core issue is a vulnerability in biometric authentication allowing an attacker to bypass security controls. The connected Red Hat and NVD entries confirm th...

CVE-2020-10851

CVE-2020-10851 affects Samsung mobile devices running P (9.0) and Q (10.0) software. The issue is a stack overflow in the kperfmon driver, leading to potentially code execution or instability as described in the public CVE entry. Connected sources reiterate the same root cause but do not provide ...

CVE-2020-25047

CVE-2020-25047 affects Samsung mobile devices on Android P/Q where the S Secure app does not enforce the intended password requirement for a locked application. Root cause: insufficient password enforcement in S Secure. Impact is partial confidentiality and potential access to a locked app; CVE s...

CVE-2020-27026

CVE-2020-27026 affects Android 11 devices (as described: Android-11) where the lock screen/unlock interface during boot behaves differently depending on whether a fingerprint is registered. This can lead to local information disclosure without additional execution privileges. The vulnerability is...

CVE-2020-27049

Summary (CVE-2020-27049) : The issue lies in Android’s rw_t3t_send_raw_frame (rw_t3t.cc). A missing bounds check causes an out-of-bounds write in the T3T (Type 3 Tag) handling path, enabling local escalation of privilege with no additional execution privileges, and requiring user interaction to e...

CVE-2020-27050

CVE-2020-27050 affects Android 11 with an issue in rw_i93_send_cmd_write_multi_blocks (rw_i93.cc). The root cause is a heap buffer overflow causing an out-of-bounds write, which the description states could lead to local privilege escalation with no additional execution privileges required. User ...

CVE-2020-27052

CVE-2020-27052 concerns Android 11 where in ActivityRecord.java, the getLockTaskLaunchMode path allows any app to start in Lock Task Mode via a permissions bypass. The documented impact is local elevation of privilege without additional execution privileges or user interaction. Connected sources ...

CVE-2020-27054

CVE-2020-27054 affects Android 11, where onFactoryReset in BluetoothManagerService.java lacks a permission check, enabling local escalation of privilege with no additional execution privileges and no user interaction required. The NVD entry lists CVSS v3.1 base score 7.8 (HIGH) and local attack, ...

CVE-2021-0415

CVE-2021-0415 concerns a vulnerability in the Mediatek memory management driver where a missing permission check can disclose local information without requiring user interaction. The issue affects the in-memory management component (Mediatek chipset context) and enables information leakage with ...

CVE-2021-0465

CVE-2021-0465 affects the Android kernel component used by Pixel devices, specifically the GenerateFaceMask function in face.cc. The issue is an out-of-bounds write caused by an incorrect bounds check, enabling local escalation of privilege with no extra execution privileges required and no user ...

CVE-2021-0629

The CVE-2021-0629 entry centers on the mdlactl driver, where a use-after-free leads to memory corruption and local privilege escalation, requiring System privileges but no user interaction. Multiple connected records corroborate the issue and cite patch ALPS05776625 (Issue ID ALPS05776625) as the...

CVE-2021-25384

CVE-2021-25384 describes an improper input validation in the Samsung libsdffextractor library, specifically in the function handling the Sample Rate Chunk (sdfffd_parse_chunk_PROP). The vulnerability, affecting versions prior to SMR MAY-2021 Release 1, can allow an attacker to trigger arbitrary c...

CVE-2021-25389

Samsung CVE-2021-25389 affects S Secure prior to SMR MAY-2021 Release 1, due to an improper running task check that could allow a user to access a locked app without authentication. Affected: Samsung devices running S Secure; Root cause: faulty task-check logic. Impact: partial confidentiality an...

CVE-2021-25392

CVE-2021-25392 concerns Samsung DeX backup path configuration. The Red Hat/NVD/CVE entries describe an improper protection of the backup path, enabling a local attacker to access sensitive information by changing the path. Affected component is the Dex-related backup path handling; the root cause...

CVE-2021-25412

The CVE-2021-25412 entry concerns an improper access control flaw in genericssoservice before Samsung SMR JUN-2021 Release 1. The vulnerability enables local attackers to perform protected activities with system privileges via untrusted applications, due to insufficient access restrictions on sen...

CVE-2021-25483

Summary of CVE-2021-25483 (livfivextractor) : The vulnerability affects the livfivextractor library prior to Samsung SMR Oct-2021 Release 1, due to a lack of boundary checking in a buffer which allows an out-of-bounds read. Reported across multiple feeds (NVD, Red Hat advisory, CVE lists, and CNN...

CVE-2021-25484

The CVE-2021-25484 entry concerns an improper authentication flaw in InputManagerService. Affected component: InputManagerService (Samsung SMR prior to Oct-2021 Release 1). Impact stated: it allows monitoring the touch event. Documented references indicate a Samsung security update (securityUpdat...

CVE-2022-39090

CVE-2022-39090 involves a missing permission check in the system’s power management service. The root cause is a lack of authorization in setting up the power management service, potentially allowing initial setup with no additional execution privileges. The CVSS vector from NVD indicates a Local...

CVE-2022-47496

The CVE-2022-47496 entry relates to the soter service and describes a missing bounds check that enables an out-of-bounds write. This can cause local denial of service with System-level privileges. Exploitation details are not provided in the documents. Multiple connected sources (Red Hat, NVD, PR...

CVE-2022-48380

CVE-2022-48380 affects the UNISOC modem control device. The vulnerability is an out-of-bounds write caused by a missing bounds check in the modem control component, enabling local denial of service with SYSTEM-level privileges required. Public exploit details are not provided in the available doc...

CVE-2022-48447

CVE-2022-48447 affects the telephony service. The root cause is a missing permission check, which could allow a local attacker to cause a denial of service with no additional execution privileges. The available documents describe the vulnerability and its impact but do not specify a patch/version...

CVE-2022-48463

CVE-2022-48463 affects the wifi service with a missing bounds check that enables an out-of-bounds write. This can lead to local denial of service without extra privileges (CVSS: LOCAL, LOW attack complexity, ALLOWs LOCAL access; impact is Availability HIGH). No concrete fixes or affected versions...

CVE-2023-20681

CVE-2023-20681 affects adsp with a possible out-of-bounds write due to improper input validation, enabling local escalation of privilege with SYSTEM privileges. Exploitation requires no user interaction; no public exploit details are provided in the connected documents. Patch ALPS07696134 (Issue ...

CVE-2023-20750

The CVE-2023-20750 entry concerns the swpm module in MediaTek chips, describing a race-condition that can cause an out-of-bounds write. This could lead to local information disclosure, with system execution privileges needed for exploitation and no user interaction required. Public references not...

CVE-2023-20759

In cmdq, a memory corruption flaw is caused by a missing bounds check, potentially enabling local denial of service with SYSTEM privileges. Exploitation does not require user interaction. A patch is available (Patch ID: ALPS07636133; Issue ID: ALPS07634601).

CVE-2023-20773

CVE-2023-20773 affects vow with a missing permission check that enables local privilege escalation. Documented impact is local escalation without extra execution privileges; user interaction is not required. Reported affected hardware in related sources includes MediaTek chips (e.g., MT6580, MT67...

CVE-2023-20822

CVE-2023-20822 affects netdagent and involves an out-of-bounds write caused by a missing bounds check. The issue can lead to local escalation of privilege with System execution privileges required, and exploitation does not require user interaction. A patch referenced in sources is ALPS07944012 (...

CVE-2023-21323

CVE-2023-21323 is an information-disclosure vulnerability in Android's Activity Manager that could let a local attacker determine whether an app is installed without query permissions. The issue stems from a side-channel disclosure, requiring no user interaction and no additional execution privil...

CVE-2023-30915

CVE-2023-30915 : The issue is a missing permission check in the email service , enabling possible local information disclosure without extra execution privileges. The NVD entry lists a CVSS v3.1 base score of 5.5 (MEDIUM), with LOCAL attack vector, LOW attack complexity and LOW privileges require...

CVE-2023-30929

CVE-2023-30929 describes a local privilege escalation in the telephony service due to a missing permission check. Connected sources link this to UNISOC chipset telephony implementations (e.g., SC98xx/SC77xx/T610 and related models) and similar Red Hat/NVD entries reiterate the local-privilege imp...

CVE-2023-30937

CVE-2023-30937 describes a missing permission check in the telephony service that could allow local information disclosure with no extra privileges. Documents confirm this flaw affects the telephony component (noted in Red Hat/NVD records) and is associated with UNISOC chipsets/telephony implemen...

CVE-2023-33890

CVE-2023-33890 concerns a missing permission check in the telephony service, enabling local information disclosure without extra privileges. Multiple sources (including UNISOC-related disclosures) consistently attribute the issue to the telephony component, with an attack vector classified as LOC...

CVE-2023-38444

CVE-2023-38444 concerns the vowifiservice component, where a missing permission check is the root cause. This enables local privilege escalation with no additional execution privileges, with an attack vector localized to the host. The connected documents confirm the issue and its impact but do no...

CVE-2023-38454

CVE-2023-38454 concerns the vowifi service where a missing permission check could allow local information disclosure with no extra privileges. The vulnerability is described across multiple feeds as affecting vowifi service components, but the connected documents do not provide specific vulnerabl...

CVE-2023-38464

CVE-2023-38464 affects the vowifiservice component (in UNISOC chipsets). The security issue is a missing permission check that could allow local escalation of privilege without requiring additional execution privileges. The CVSS 3.1 vector from NVD indicates a Local, Low Complexity exploit with L...

CVE-2023-40639

The CVE-2023-40639 issue concerns the SoundRecorder service with a missing permission check that could lead to local information disclosure without requiring additional privileges. Multiple sources (NVD, Red Hat CVE page, CVE lists) confirm the vulnerability description and classify the impact as...

CVE-2023-42721

The CVE-2023-42721 entry concerns the flv extractor component, where missing input validation is the reported root cause. This vulnerability could allow local denial of service without requiring user interaction or additional privileges, as described in multiple connected records (notably the Red...

CVE-2023-42735

CVE-2023-42735 affects the telephony service (noted by NVD/Red Hat/PRION/CVE list). The vulnerability arises from a missing permission check in the telephony service, enabling local information disclosure with System execution privileges needed. CVSS v3.1 indicates a Local attack, Low attack comp...

CVE-2023-42751

CVE-2023-42751 affects the gnss service. The vulnerability is described as a missing bounds check that can cause an out-of-bounds write, leading to local denial of service with System execution privileges. The available connected documents confirm the issue and provide no explicit patch/version f...

CVE-2023-48356

CVE-2023-48356 concerns the jpg driver in UNISOC chipsets. The root cause is a missing bounds check leading to an out-of-bounds write. This can cause local denial of service with system execution privileges required. The available sources (NVD/Red Hat/linked records) describe the vulnerability an...

CVE-2024-20121

CVE-2024-20121 concerns a possible out-of-bounds write in KeyInstall caused by a missing bounds check. The vulnerability could allow local escalation of privilege with System execution privileges required, and no user interaction is needed for exploitation. Technical details across sources consis...