CVE-2018-9569

CVE-2018-9569 affects Android 9, involving an out-of-bounds write in impd_init_drc_decode_post_config within impd_drc_gain_decoder.c. The issue originates from an incorrect bounds check, enabling potential remote code execution with no extra privileges required, with user interaction needed for e...

CVE-2018-9576

CVE-2018-9576 affects Android 9 and is due to an out-of-bounds write in impd_parse_parametric_drc_instructions (impd_drc_static_payload.c) with missing bounds checks. Exploitation could lead to remote code execution and requires user interaction. The vulnerability is tied to the Android 9 stack; ...

CVE-2019-2141

The CVE-2019-2141 issue affects Android 10, specifically the libxaac library. The root cause is an out-of-bounds write due to a missing bounds check in libxaac, which could enable remote code execution. The vulnerability is described as requiring user interaction for exploitation and having poten...

CVE-2019-2154

CVE-2019-2154 affects the Android 10 libxaac library, where an out-of-bounds read due to a missing bounds check could disclose information. The vulnerability allows information disclosure without executing code, with user interaction required for exploitation. The connected Red Hat advisory reite...

CVE-2019-2189

CVE-2019-2189 affects the Image driver in the Android kernel (Easel driver). The vulnerability stems from race conditions that can cause memory corruption, enabling local elevation of privilege to SYSTEM with no user interaction required. Impact is described as local EoP with high confidentiality...

CVE-2019-9318

CVE-2019-9318: A missing variable initialization in libhevc on Android-10 (Android 10) can cause information disclosure. Exploitation requires user interaction; no remote code execution is stated. Affected component: libhevc in Android 10, with CVE details echoed across NVD/Red Hat/CVEs. Mitigati...

CVE-2019-9323

CVE-2019-9323 affects the Android Wallpaper Manager service. The issue is an information disclosure caused by a missing permission check, allowing any application to access the wallpaper image without extra privileges, with no user interaction required. The Android 10 release notes indicate this ...

CVE-2019-9357

CVE-2019-9357 affects libAACdec in Android 10’s Media Framework. An integer overflow can trigger an out-of-bounds write, enabling remote code execution. Exploitation requires user interaction; no privileges beyond the user. Android 10 patch level 2019-09-01 or later mitigates via released securit...

CVE-2019-9362

CVE-2019-9362 affects the Android 10 libSACdec component, where a missing bounds check can cause an out-of-bounds read and potential information disclosure. The issue is described as a remote information disclosure vulnerability with user interaction required for exploitation; no exploitation det...

CVE-2019-9378

CVE-2019-9378 affects Android 10 in the Framework/Activity Manager area, where a permission check weakness allows local elevation of privileges without user interaction. The issue enables a bypass of access controls to gain higher privileges on the device, with Local attack vector and no authenti...

CVE-2019-9395

CVE-2019-9395 affects Android 10 Bluetooth. A missing bounds check can cause controlled termination, leading to remote DoS without privileges and without user interaction. Impact: availability loss; threat vector: network. Root cause: out-of-bounds condition in Bluetooth handling. Mitigation: app...

CVE-2019-9473

CVE-2019-9473 affects the Android 10 Bluetooth stack. The issue is an out-of-bounds read caused by a missing bounds check in Bluetooth code, leading to remote information disclosure without extra execution privileges. Exploitation does not require user interaction and can be achieved over the net...

CVE-2020-0139

CVE-2020-0139 affects Android 10. The vulnerability is a flaw in NDEF_MsgValidate (ndef_utils.c) where an integer overflow can cause an out-of-bounds read, potentially enabling local information disclosure when a malformed NFC tag is processed by the firmware. Exploitation is described as requiri...

CVE-2020-0165

CVE-2020-0165 affects Android 10. The issue is a potential out-of-bounds write in phNxpNciHal_NfcDep_cmd_ext (nfc driver code), caused by a missing bounds check, enabling local escalation of privilege with System execution privileges; no user interaction required. CVSSv3.1 base score 6.7 (Local, ...

CVE-2020-0169

CVE-2020-0169 affects Android 10: In RTTTL_Event of eas_rtttl.c, there is a missing bounds check that can cause resource exhaustion, leading to remote Denial of Service. Exploitation requires user interaction. The issue is documented across multiple feeds (NVD entry for CVE-2020-0169, RH Red Hat ...

CVE-2020-0170

CVE-2020-0170 affects Android 10, with the vulnerability located in IMY_Event within eas_imelody.c. The issue is a missing bounds check in a resource-management path that can cause resource exhaustion, leading to remote denial of service. Exploitation requires user interaction. The provided docum...

CVE-2020-0274

The CVE-2020-0274 issue affects the Android 11 OMX parser, where a returned raw pointer can cause local information disclosure without requiring user interaction. This is described across multiple sources (NVD/Red Hat/CNVD entries) as an information-disclosure vulnerability tied to the OMX parser...

CVE-2020-0287

The CVE-2020-0287 issue affects libmkvextractor in Android 11. The vulnerability is a resource exhaustion (Denial of Service) caused by a missing bounds check in a component handling MKV extraction. It can be exploited remotely with network access, but requires user interaction to trigger the fla...

CVE-2020-0291

CVE-2020-0291 affects Android 11 and is described as a Bluetooth out-of-bounds read due to a missing bounds check. It could enable local information disclosure with System execution privileges and does not require user interaction. Exploitation details are not provided in the supplied documents. ...

CVE-2020-0352

CVE-2020-0352 affects Android 11 MediaProvider. The vulnerability is a SQL injection in MediaProvider that can bypass permissions, enabling local information disclosure without extra privileges or user interaction. Impact is limited to partial confidentiality loss on affected devices. Remediation...

CVE-2020-0359

CVE-2020-0359 affects the Android GLESRenderEngine on Android 11, where an out-of-bounds read caused by a buffer overflow could enable local information disclosure without user interaction. The issue is described as a local vulnerability with no execution privileges required and no interaction ne...

CVE-2020-0364

CVE-2020-0364 affects Android 11 via libDRCdec, where a missing bounds check causes an out-of-bounds read that can disclose information remotely. Exploitation requires user interaction. The issue is documented as fixed in the Android 11 security release notes; update to Android 11 with the patch ...

CVE-2020-0405

CVE-2020-0405 affects Android 11. In the NetworkStackNotifier, an unsafe implicit PendingIntent can bypass permissions, enabling local elevation of privilege with User execution privileges required but no user interaction. Documentation across multiple sources (NVD/Red Hat/CNVD) confirms this vul...

CVE-2020-0479

The CVE-2020-0479 issue affects Android 11 and is described as a permissions bypass in DocumentsProvider.java (callUnchecked), enabling a malicious app to access files managed by a DocumentProvider without user permission. Exploitation requires user interaction, and the vulnerability allows local...

CVE-2020-0481

This CVE (CVE-2020-0481) concerns Android where in AndroidManifest.xml a permissions bypass enables local elevation of privilege. The impact is that a non-system app could broadcast without having required permissions, with no user interaction. Affected info from the sources specifies Android 11 ...

CVE-2020-0491

CVE-2020-0491 affects Android 11 on Pixel devices. The issue is in readBlock of MatroskaExtractor.cpp, where resource exhaustion can cause a denial of service. This can enable remote DoS with user interaction required for exploitation. Exploitation details, affected build patches, and concrete re...

CVE-2020-10839

CVE-2020-10839 affects Samsung mobile devices running Android O (8.x), P (9.0), and Q (10.0), where attackers can bypass Factory Reset Protection (FRP) via a SIM card. The vulnerability is associated with Samsung ID SVE-2019-16193 (Feb 2020). Public references in connected sources reiterate the F...

CVE-2020-10852

CVE-2020-10852 involves a stack overflow in the display driver affecting Samsung mobile devices running O(8.x), P(9.0), and Q(10.0) software (Samsung ID SVE-2019-15877). The Red Hat/EUVD/CNVD entries corroborate the same issue. According to the NVD metrics, CVSS v3.1 base score is 7.8 (HIGH) with...

CVE-2020-27030

CVE-2020-27030 (Android 11) describes a permission bypass caused by a flaw in HandleApiCalls.java during onCreate, enabling local escalation of privilege via a confused deputy. This could let an app set or dismiss alarms without additional privileges, with no user interaction required. Exploitati...

CVE-2020-27041

In CVE-2020-27041, the issue is in Android 11’s ConnectivityService.java showProvisioningNotification where an unsafe PendingIntent could allow local information disclosure of notification data without extra privileges or user interaction. The vulnerability is a local disclosure due to PendingInt...

CVE-2020-27053

CVE-2020-27053 affects Android 11. In ClientModeImpl.java, broadcastWifiCredentialChanged has a missing permission check causing a location permission bypass. This could lead to local disclosure of the WiFi network name with System execution privileges; no user interaction is required for exploit...

CVE-2020-27056

CVE-2020-27056 affects Android 11 with a missing permission check in SELinux MLS policies that can disclose local package-metadata information without extra privileges. The issue is confirmed as a local information-disclosure vulnerability; no exploitation details are provided in the documents. R...

CVE-2021-0415

CVE-2021-0415 concerns a vulnerability in the Mediatek memory management driver where a missing permission check can disclose local information without requiring user interaction. The issue affects the in-memory management component (Mediatek chipset context) and enables information leakage with ...

CVE-2021-0455

The CVE-2021-0455 issue is described as an out-of-bounds write in the Citadel chip firmware, caused by a missing bounds check. It grants local elevation of privilege with System execution privileges required, and requires no user interaction to exploit. In the provided materials, the vulnerabilit...

CVE-2021-0629

The CVE-2021-0629 entry centers on the mdlactl driver, where a use-after-free leads to memory corruption and local privilege escalation, requiring System privileges but no user interaction. Multiple connected records corroborate the issue and cite patch ALPS05776625 (Issue ID ALPS05776625) as the...

CVE-2021-25384

CVE-2021-25384 describes an improper input validation in the Samsung libsdffextractor library, specifically in the function handling the Sample Rate Chunk (sdfffd_parse_chunk_PROP). The vulnerability, affecting versions prior to SMR MAY-2021 Release 1, can allow an attacker to trigger arbitrary c...

CVE-2021-25412

The CVE-2021-25412 entry concerns an improper access control flaw in genericssoservice before Samsung SMR JUN-2021 Release 1. The vulnerability enables local attackers to perform protected activities with system privileges via untrusted applications, due to insufficient access restrictions on sen...

CVE-2021-25413

CVE-2021-25413 affects Samsung Contacts prior to SMR June-2021 Release 1. The root cause is improper sanitization of incoming intents, enabling a local attacker to access arbitrary data within the Samsung Contacts privilege. Impact is partial confidentiality exposure of data via a local vector. T...

CVE-2021-25416

The CVE-2021-25416 issue concerns Samsung SMR (system patch package). An improper address validation in RKP before SMR JUN-2021 Release 1 can let a local attacker, with EL1 assumed compromised, create kernel pages outside the code area. This is a local-exploit scenario with potential high impact ...

CVE-2021-25484

The CVE-2021-25484 entry concerns an improper authentication flaw in InputManagerService. Affected component: InputManagerService (Samsung SMR prior to Oct-2021 Release 1). Impact stated: it allows monitoring the touch event. Documented references indicate a Samsung security update (securityUpdat...

CVE-2022-30757

CVE-2022-30757 concerns the Samsung isemtelephony component. The available disclosures state an improper authorization flaw that lets an attacker obtain the device CID without the ACCESS_FINE_LOCATION permission, affecting versions before the Samsung SMR Jul-2022 Release 1. Public sources consist...

CVE-2022-38685

CVE-2022-38685 affects UNISOC chipsets’ Bluetooth service module, where a missing privilege check in the Bluetooth service could allow local denial of service without extra execution privileges. The issue is documented across multiple sources (NVD/NVD mirror and related catalogs) with this root c...

CVE-2022-47491

CVE-2022-47491 concerns the UNISOC-soter service, where a missing bounds check enables an out-of-bounds write. This could yield local denial of service with execution privileges required. The NVD notes a CVSS v3.1 base score of 4.4 (MEDIUM); attack vector LOCAL, privilege requirement HIGH, and av...

CVE-2022-48460

CVE-2022-48460 affects the UNISOC setting service. The root cause is undefined behavior from incorrect error handling, leading to local denial of service without additional privileges. Public details across connected documents confirm the issue’s nature but do not specify exact affected products/...

CVE-2022-48463

CVE-2022-48463 affects the wifi service with a missing bounds check that enables an out-of-bounds write. This can lead to local denial of service without extra privileges (CVSS: LOCAL, LOW attack complexity, ALLOWs LOCAL access; impact is Availability HIGH). No concrete fixes or affected versions...

CVE-2023-20772

CVE-2023-20772 affects the vow component, where a missing permission check enables local escalation of privilege without requiring user interaction. The issue can be exploited locally to gain higher privileges, as indicated by the CVSS data (LOCAL vector, high confidentiality/integrity/availabili...

CVE-2023-20807

CVE-2023-20807 affects MediaTek’s dpe component, where a missing bounds check enables an out-of-bounds write. This is described as a local escalation of privilege with System execution privileges required, and no user interaction is needed for exploitation. The issue is associated with the dpe mo...

CVE-2023-20851

CVE-2023-20851 affects stc with a race-condition leading to an out-of-bounds read and local escalation of privilege. Impact requires System execution privileges and user interaction for exploitation, per multiple feeds. A patch is available (Patch ID ALPS08048635; Issue ID ALPS08048635). Exploita...

CVE-2023-21323

CVE-2023-21323 is an information-disclosure vulnerability in Android's Activity Manager that could let a local attacker determine whether an app is installed without query permissions. The issue stems from a side-channel disclosure, requiring no user interaction and no additional execution privil...

CVE-2023-21345

CVE-2023-21345 is described as an information-disclosure issue in Android’s Game Manager Service where an attacker can determine if an app is installed without query permissions via a side-channel. The available documents indicate local exploitation with no user interaction and a low overall risk...