Lucene search
+L
GoogleAndroid

8153 matches found

CVE
CVE
added 2024/10/07 2:35 a.m.116 views

CVE-2024-20100

CVE-2024-20100 concerns a possible out-of-bounds write in the MediaTek wlan driver, caused by improper input validation. The issue could allow remote code execution with no privileges or user interaction required. Connected sources consistently identify the affected component as the MediaTek WLAN...

9.8CVSS7.9AI score0.00333EPSS
Save
CVE
CVE
added 2024/03/11 6:55 p.m.116 views

CVE-2024-22010

The CVE-2024-22010 issue affects the dvfs_plugin_caller function in fvp.c, described as an out-of-bounds read caused by a missing bounds check. This leads to local information disclosure without requiring special privileges or user interaction. Several connected sources (Red Hat, NVD, OSV) reiter...

5.5CVSS6AI score0.00098EPSS
Save
CVE
CVE
added 2024/07/09 8:9 p.m.116 views

CVE-2024-23711

CVE-2024-23711 describes a logic error in DevmemXIntUnreserveRange within devicemem_server.c that enables arbitrary code execution and local kernel privilege escalation without extra privileges or user interaction. Multiple sources (NVD, Red Hat, OSV) corroborate the same root cause. Impact is hi...

7.8CVSS7.4AI score0.00103EPSS
Save
CVE
CVE
added 2024/11/13 5:13 p.m.116 views

CVE-2024-23715

CVE-2024-23715: Out-of-bounds write in PMRWritePMPageList within pmr.c triggers local kernel privilege escalation with no user interaction. Multiple sources (NVD, Red Hat, CNVD, CN)** corroborate a kernel-level issue described as a logic error enabling LPE. Affected component is the kernel; remed...

7.8CVSS6.8AI score0.00103EPSS
Save
CVE
CVE
added 2024/03/11 6:55 p.m.116 views

CVE-2024-25985

The CVE-2024-25985 issue affects the bigo_unlocked_ioctl path in bigo.c, described as a Use-After-Free caused by a missing bounds check. The impact is local privilege escalation with high severity (CVSS: LOCAL, NONE user interaction). Documents in multiple feeds (NVD, Red Hat, PRION, OSV) consist...

8.4CVSS7AI score0.0009EPSS
Save
CVE
CVE
added 2024/03/11 6:55 p.m.116 views

CVE-2024-27205

CVE-2024-27205 describes memory corruption due to a use-after-free, leading to local escalation of privilege with no user interaction. The available documents indicate a HIGH-severity, LOCAL-exploitation scenario with no exploitation prerequisites; no specific affected product/version or fix is p...

8.4CVSS7.2AI score0.0009EPSS
Save
CVE
CVE
added 2024/03/11 6:55 p.m.116 views

CVE-2024-27225

The CVE-2024-27225 entry concerns Google Pixel devices. In the Bluetooth HCI code path (bluetooth_hci.cc, sendHciCommand) there is an out-of-bounds read due to a heap buffer overflow. This can cause local information disclosure with system execution privileges; no user interaction is required for...

4.4CVSS6.2AI score0.00087EPSS
Save
CVE
CVE
added 2024/07/09 8:9 p.m.116 views

CVE-2024-31322

Summary of CVE-2024-31322 : In Android’s AccessibilityManagerService.updateServicesLocked, improper input validation can let an app be hidden from Settings while still retaining the Accessibility Service, enabling local elevation of privilege with no extra execution privileges required. Exploitat...

7.8CVSS6.8AI score0.00103EPSS
Save
CVE
CVE
added 2024/11/13 5:13 p.m.116 views

CVE-2024-34719

CVE-2024-34719 is a local elevation-of-privilege vulnerability in Google Android involving a permissions bypass due to a missing null check. It affects Android Framework components and is rated High for impact (EoP) with local attack vector and no user interaction required. The Red Hat and Androi...

8.4CVSS6.9AI score0.00114EPSS
Save
CVE
CVE
added 2025/01/28 7:13 p.m.116 views

CVE-2024-34733

CVE-2024-34733 involves DevmemXIntMapPages in devicemem_server.c, with an integer overflow that could enable arbitrary code execution and local kernel-level privilege escalation. Exploitation is described as requiring local access with no user interaction. The Red Hat entry confirms the same desc...

8.4CVSS8AI score0.00089EPSS
Save
CVE
CVE
added 2024/11/13 5:25 p.m.116 views

CVE-2024-43090

CVE-2024-43090 affects the Android Framework component, describing a cross-user image read caused by a missing permission check. This leads to local information disclosure with user privileges required, as noted in multiple sources (Android OS CVE entry and related bulletins). The Android securit...

5CVSS6.2AI score0.00163EPSS
Save
CVE
CVE
added 2017/01/12 8:0 p.m.115 views

CVE-2017-0381

CVE-2017-0381 is an information-disclosure vulnerability in silk/NLSF_stabilize.c within libopus used by Mediaserver, affecting Android versions 5.0.2–7.1. It could allow a local malicious app to access data outside its permissions. The concrete root: a flaw in Opus handling as described in the C...

9.3CVSS6.3AI score0.01059EPSS
Save
CVE
CVE
added 2020/07/17 8:10 p.m.115 views

CVE-2020-0226

CVE-2020-0226 affects Android 10 in the Media Framework. The flaw is a type-confusion–induced out-of-bounds write in Client.cpp:createWithSurfaceParent, enabling local escalation of privilege in the graphics server without requiring user interaction. Documents at NVD/Red Hat/CVE listings confirm ...

7.8CVSS7.7AI score0.00273EPSS
Save
CVE
CVE
added 2020/10/14 1:6 p.m.115 views

CVE-2020-0377

CVE-2020-0377 targets Android Bluetooth stack: in gatt_process_read_by_type_rsp of gatt_cl.cc, a missing bounds check allows an out-of-bounds read, enabling remote information disclosure on Bluetooth servers without extra privileges. Affected: Android 8.0–11 (Android-8.0, 8.1, 9, 10, 11) per the ...

7.8CVSS7AI score0.01891EPSS
Save
CVE
CVE
added 2020/09/17 3:43 p.m.115 views

CVE-2020-0393

CVE-2020-0393 affects Android during 9–11 in the Media Framework: decrypt and decrypt_1_2 in CryptoPlugin.cpp allow an out-of-bounds read due to a missing bounds check, enabling local information disclosure without user interaction. The issue is documented in multiple sources (NVD/NVD CVSS detail...

5.5CVSS5AI score0.00158EPSS
Save
CVE
CVE
added 2020/10/14 1:4 p.m.115 views

CVE-2020-0410

CVE-2020-0410: In SapServer.java setNotification, a PendingIntent misconfiguration enables a local permission bypass that could lead to information disclosure with user privileges; exploitation requires no user interaction. Affected: Android 8.0–11 (per CVE entry). Impact: partial confidentiality...

5.5CVSS5AI score0.00157EPSS
Save
CVE
CVE
added 2020/11/10 12:48 p.m.115 views

CVE-2020-0448

CVE-2020-0448 : In TelecomServiceImpl.getPhoneAccountsForPackage, a missing permission check can allow disclosure of a tracking identifier, enabling account tracking across devices with no extra privileges. Impact described as local information disclosure of the identifier (no integrity/DoS impac...

5.5CVSS5.1AI score0.00155EPSS
Save
CVE
CVE
added 2021/02/10 4:49 p.m.115 views

CVE-2021-0335

CVE-2021-0335 affects Google's Android 11 Media Framework. The vulnerability arises from an out-of-bounds write in C2SoftHevcDec.cpp caused by a use-after-free, enabling remote information disclosure without additional execution privileges. Exploitation requires user interaction. The issue is doc...

6.5CVSS6.2AI score0.00842EPSS
Save
CVE
CVE
added 2021/04/13 6:24 p.m.115 views

CVE-2021-0471

CVE-2021-0471 : In Android, the decrypt_1_2 function in CryptoPlugin.cpp can trigger an out-of-bounds read due to an integer overflow, leading to local information disclosure without extra privileges or user interaction. Affected: Android 8.1, 9, 10, 11. No public details in the connected docs sp...

5.5CVSS5AI score0.00124EPSS
Save
CVE
CVE
added 2021/06/21 4:1 p.m.115 views

CVE-2021-0523

CVE-2021-0523 affects Android (notably Android-10/Android-11) via a tapjacking/overlay fault in WifiScanModeActivity.java that could enable Wi‑Fi scanning without consent, leading to local elevation of privilege with user execution required. Documents confirm the root cause (overlay/tapjacking in...

7.3CVSS7.2AI score0.00118EPSS
Save
CVE
CVE
added 2021/12/15 6:5 p.m.115 views

CVE-2021-0925

CVE-2021-0925 is associated with Google Android 12. The vulnerability occurs in rw_t4t_sm_detect_ndef (rw_t4t.cc) and is an out-of-bounds read caused by an incorrect bounds check, leading to potential remote information disclosure without extra execution privileges or user interaction. Documents ...

7.8CVSS7AI score0.00956EPSS
Save
CVE
CVE
added 2022/06/15 1:23 p.m.115 views

CVE-2022-20205

CVE-2022-20205 describes an information-disclosure issue in Android where isFileUri in FileUtil.java may bypass the file:// scheme check due to improper input validation. The vulnerability allows local information disclosure without extra privileges, with exploitation not requiring user interacti...

5.5CVSS5.1AI score0.0011EPSS
Save
CVE
CVE
added 2022/10/11 12:0 a.m.115 views

CVE-2022-20436

CVE-2022-20436 is an elevation-of-privilege vulnerability in Android involving an unauthorized service in the system service, where a component lacks permission checks, enabling Local EoP. The core issue is described across multiple sources as an Android/UNISOC Android component vulnerability aff...

7.8CVSS7.5AI score0.00159EPSS
Save
CVE
CVE
added 2023/03/24 12:0 a.m.115 views

CVE-2022-20532

In CVE-2022-20532, the vulnerability lies in MPEG4Extractor.cpp’s parseTrackFragmentRun() where an integer overflow can cause an out-of-bounds read. This may enable remote elevation of privileges without user interaction on Android 13 devices. Documented impact is high across confidentiality, int...

9.8CVSS8.8AI score0.00489EPSS
Save
CVE
CVE
added 2022/12/16 12:0 a.m.115 views

CVE-2022-20586

CVE-2022-20586 describes an elevation of privilege in the Android kernel due to improper input validation in the function valid_out_of_special_sec_dram_addr within drm_access_control.c. The vulnerability could allow local escalation of privilege without any additional execution privileges, with a...

7.8CVSS7.7AI score0.00125EPSS
Save
CVE
CVE
added 2022/06/06 5:39 p.m.115 views

CVE-2022-21755

The CVE-2022-21755 entry concerns a MediaTek WLAN driver vulnerability: an out-of-bounds read caused by an incorrect bounds check. This could allow local information disclosure and potentially system-privilege execution, with no user interaction required. Patch ALPS06545464/Issue ALPS06545464 is ...

4.4CVSS4.2AI score0.00109EPSS
Save
CVE
CVE
added 2022/01/21 6:17 p.m.115 views

CVE-2022-23728

CVE-2022-23728 concerns an LG smartphone vulnerability where an attacker can reset the device using AT Command during the reboot process (LG ID LVE-SMP-210011). The CVSSv3.1 vector indicates physical access, low complexity, no privileges required, and no user interaction, with impact on integrity...

6.6CVSS6.3AI score0.00104EPSS
Save
CVE
CVE
added 2022/10/07 12:0 a.m.115 views

CVE-2022-26471

CVE-2022-26471 affects MediaTek telephony components. The root cause is a package/parcel format mismatch that enables local privilege escalation with no additional execution privileges or user interaction required. The NVD entry reports a CVSS v3.1 base score of 7.8 (High) with LOCAL attack vecto...

7.8CVSS7.7AI score0.00103EPSS
Save
CVE
CVE
added 2022/12/06 12:0 a.m.115 views

CVE-2022-39106

CVE-2022-39106 : Concrete details from connected sources show an out-of-bounds write in the kernel sensor driver for Unisoc devices, caused by a missing bounds check. This can lead to local denial of service. The documents do not specify affected models/versions or a fixed patch version. No explo...

5.5CVSS5.4AI score0.00117EPSS
Save
CVE
CVE
added 2022/12/06 12:0 a.m.115 views

CVE-2022-39133

CVE-2022-39133 is described as a missing bounds check in the wlan driver, which could cause a local denial of service in wlan services. The NVD entry lists a CVSSv3.1 base score of 5.5 (Medium), with LOCAL attack vector, LOW attack complexity, LOW privileges required, no user interaction, and an ...

5.5CVSS5.3AI score0.00117EPSS
Save
CVE
CVE
added 2023/03/24 12:0 a.m.115 views

CVE-2022-42499

CVE-2022-42499 affects the Android modem component sms_MmConManagement.c, where a heap buffer overflow can cause an out-of-bounds write. This vulnerability could enable remote code execution with no privileges and no user interaction required. Publicly available details in the Red Hat, NVD, and C...

9.8CVSS9.3AI score0.00503EPSS
Save
CVE
CVE
added 2023/04/06 12:0 a.m.115 views

CVE-2023-20656

CVE-2023-20656 affects MediaTek geniezone: a logic error enables an out-of-bounds write that could allow local escalation of privilege with System privileges required. Public details in the sources indicate no user interaction is necessary. The issue is tracked with ALPS07571494 (Patch ID) and is...

6.7CVSS6.7AI score0.00095EPSS
Save
CVE
CVE
added 2023/12/04 10:40 p.m.115 views

CVE-2023-21218

CVE-2023-21218 : The vulnerability is in PMRChangeSparseMemOSMem of physmem_osmem_linux.c, where an incorrect bounds check allows an out-of-bounds write. This could enable local escalation of privilege in the Linux kernel without extra execution privileges or user interaction. Public sources in t...

9.8CVSS8.5AI score0.00414EPSS
Save
CVE
CVE
added 2023/07/12 11:25 p.m.115 views

CVE-2023-21243

CVE-2023-21243 is a buffer overflow in the Android PasspointConfiguration.java code path (validateForCommonR1andR2) that can inflate a config file’s size without limits, enabling a local denial-of-service condition. Exploitation requires user interaction, and exploitation status is not indicated ...

5.5CVSS5.5AI score0.00108EPSS
Save
CVE
CVE
added 2024/05/06 2:51 a.m.115 views

CVE-2023-32873

The CVE-2023-32873 issue affects MediaTek’s keyInstall module, where a missing bounds check enables an out-of-bounds write that could lead to local escalation of privilege with SYSTEM privileges. Exploitation details are not provided in the connected documents. Impact is described as requiring no...

6.7CVSS7AI score0.00085EPSS
Save
CVE
CVE
added 2023/12/08 3:39 p.m.115 views

CVE-2023-48398

CVE-2023-48398 affects the ProtocolNetAcBarringInfo::ProtocolNetAcBarringInfo() function in protocolnetadapter.cpp, where a missing bounds check can cause an out-of-bounds read. This can lead to remote information disclosure and requires baseband firmware compromise, with no user interaction need...

7.5CVSS7AI score0.00334EPSS
Save
CVE
CVE
added 2024/03/04 2:43 a.m.115 views

CVE-2024-20020

OP-TEE (Trusted Execution Environment) vulnerability CVE-2024-20020 involves an out-of-bounds write caused by an incorrect bounds check. This could enable local information disclosure with System execution privileges required, and no user interaction is needed. The issue is tracked with patch ALP...

4.4CVSS6.1AI score0.0012EPSS
Save
CVE
CVE
added 2024/11/04 1:48 a.m.115 views

CVE-2024-20106

CVE-2024-20106 affects MediaTek’s m4u component. The issue is a missing bounds check causing a possible out-of-bounds write, enabling local privilege escalation with System-level privileges and no user interaction required. A patch is available: ALPS08960505 (MSV-1590). Other connected records co...

6.7CVSS7.2AI score0.00084EPSS
Save
CVE
CVE
added 2025/01/06 3:17 a.m.115 views

CVE-2024-20140

CVE-2024-20140 concerns MediaTek power module code with a missing bounds check, causing an out-of-bounds write. This can enable local escalation of privilege to System level without user interaction, as described across NVD/Red Hat/OSV/NCSC and related advisories. The root cause is an out-of-boun...

6.7CVSS7.3AI score0.00082EPSS
Save
CVE
CVE
added 2024/11/13 5:25 p.m.115 views

CVE-2024-43089

CVE-2024-43089 affects the Android MediaProvider component. The root cause is a missing permission check in the MediaProvider.updateInternal method, which can allow an attacker to access another app’s files and achieve local elevation of privilege. The impact is limited to local privilege escalat...

7.8CVSS7.1AI score0.00097EPSS
Save
CVE
CVE
added 2016/05/09 10:0 a.m.114 views

CVE-2016-4477

CVE-2016-4477 affects wpa_supplicant (and hostapd) when updating WPA/WPA2 passphrases: input containing newline/control characters can cause the updated configuration to execute code or disrupt service. In practice, this enables local privilege escalation via the control interface (SET_NETWORK) a...

7.8CVSS7.2AI score0.00255EPSS
Save
CVE
CVE
added 2019/06/19 7:52 p.m.114 views

CVE-2019-1990

CVE-2019-1990 affects Android’s Media framework, specifically the ihevcd_fmt_conv_420sp_to_420p path in ihevcd_fmt_conv.c. The issue is an out-of-bounds write caused by a missing bounds check, enabling remote code execution with user interaction required. Affected Android versions: 7.0–9.0. The v...

9.3CVSS8.8AI score0.0137EPSS
Save
CVE
CVE
added 2019/06/19 7:51 p.m.114 views

CVE-2019-2004

CVE-2019-2004 describes an information-disclosure flaw in Android’s framework via InputTransport.cpp (in publishKeyEvent, publishMotionEvent, and sendUnchainedFinishedSignal) caused by uninitialized data. The issue enables local information disclosure without user interaction and affects Android ...

5.5CVSS5.2AI score0.0017EPSS
Save
CVE
CVE
added 2019/06/19 7:53 p.m.114 views

CVE-2019-2006

CVE-2019-2006 affects Android 9 where a memory corruption via use-after-free in the HalDeathHandlerHidl.cpp serviceDied can lead to local escalation of privilege in the audio server. Exploitation requires no user interaction; privileges required are NONE. The issue is categorized as Elevation of ...

10CVSS8.5AI score0.00716EPSS
Save
CVE
CVE
added 2021/04/13 6:21 p.m.114 views

CVE-2021-0432

The CVE-2021-0432 issue affects Android 11, related to ClearPullerCacheIfNecessary and ForceClearPullerCache in StatsPullerManager.cpp. The root cause is a race condition causing a use-after-free, enabling local escalation of privilege with no extra execution privileges required and no user inter...

7CVSS7AI score0.00086EPSS
Save
CVE
CVE
added 2022/10/07 12:0 a.m.114 views

CVE-2022-26472

The CVE-2022-26472 entry describes a local elevation of privilege in MediaTek IMS due to a parcel format mismatch. Affected component: ims on MediaTek chips; root cause: parcel format mismatch enabling local EoP with no user interaction and no additional execution privileges required (per the ini...

7.8CVSS7.7AI score0.00144EPSS
Save
CVE
CVE
added 2022/11/08 12:0 a.m.114 views

CVE-2022-32601

CVE-2022-32601 is a MediaTek telephony vulnerability caused by a parcel format mismatch that enables local escalation of privilege with no extra execution privileges required. Exploitation is described as local (AV:L, AC:L, PR:L) with no user interaction, and the impact is elevated privileges to ...

7.8CVSS7.7AI score0.00109EPSS
Save
CVE
CVE
added 2023/04/11 11:9 a.m.114 views

CVE-2022-47338

CVE-2022-47338 describes a missing permission check in the telecom service, leading to a local Denial of Service. Public sources consistently state the issue affects UNISOC/Android telecom components, with the impact described as local DoS and no remote exploit details provided in the supplied do...

7.1CVSS6.6AI score0.00088EPSS
Save
CVE
CVE
added 2023/10/08 3:35 a.m.114 views

CVE-2023-40638

CVE-2023-40638 affects UNISOC chipsets (Android Telecom service) where a missing permission check could allow a local Denial of Service with SYSTEM privileges required. The Red Hat/Android-related entries corroborate a local-impact scenario but do not provide explicit vulnerable versions or a con...

4.4CVSS4.7AI score0.00082EPSS
Save
CVE
CVE
added 2024/02/05 5:59 a.m.114 views

CVE-2024-20011

The CVE-2024-20011 issue affects MediaTek’s alac decoder, caused by an incorrect bounds check that enables information disclosure and could lead to remote code execution without user interaction. The vulnerability is rated high/critical with network access and no privileges required. A patch is r...

9.8CVSS8.5AI score0.00446EPSS
Save
Total number of security vulnerabilities8153