CVE-2015-5582

Summary: CVE-2015-5582 affects Adobe Flash Player and Adobe AIR components. A memory corruption vulnerability in Flash Player allows remote code execution or denial of service via parsing crafted media (SWF/MP4) payloads, with exploitable conditions indicated by related advisories. Affected produ...

CVE-2015-8955

CVE-2015-8955 affects the Linux kernel on arm64 (arch/arm64/kernel/perf_event.c) prior to 4.1. The issue arises from events across multiple HW PMUs being mishandled, allowing local users to gain privileges or trigger a denial of service via an invalid pointer dereference. Impact is limited to loc...

CVE-2018-9581

CVE-2018-9581 describes an information-disclosure flaw in Android where WiFi RSSI (and SSID) data are broadcast via intents (android.net.wifi.RSSI_CHANGE and android.net.wifi.STATE_CHANGE). This cross-process leakage can allow any on-device app to observe a user’s proximity/location context witho...

CVE-2019-2003

CVE-2019-2003 affects Android platforms (7.0–9) and is described across multiple sources (NVD, Red Hat, CVE entries, and Android bulletin) as an elevation of privilege/remote code execution risk via Linkify.java in addLinks, enabling phishing-like misdirection. Root cause is an unusual issue in L...

CVE-2020-0002

CVE-2020-0002 affects Android Media framework (ih264d_init_decoder in ih264d_api.c) with a use-after-free causing an out-of-bounds write, enabling remote code execution. Impacted Android versions: 8.0–10. Exploitation requires user interaction or crafted media; CVSS indicates Network access, no p...

CVE-2020-0228

CVE-2020-0228 affects Android’s Recorder related service, with the root cause described as an improper configuration of that recorder component. Public summaries in the connected documents indicate an information-disclosure risk (evidence includes CNVD/Red Hat listings and NVD metrics) and classi...

CVE-2020-0453

CVE-2020-0453 affects Android:66? In updateNotification of BeamTransferManager.java, an unsafe PendingIntent permits a local permission bypass leading to information disclosure with user privileges. Impact is described in Android’s 2020-11-01 bulletin under System (ID: CVE-2020-0453) with affecte...

CVE-2020-0456

CVE-2020-0456 is an out-of-bounds write due to a missing bounds check affecting Android with Android SoC A-170378843 (MediaTek vcu). CVSS v3.1 shows 9.8 (CRITICAL); CVSS v2 shows 7.5 (HIGH). Exploitation remotely over network without user interaction; impact on confidentiality, integrity, and ava...

CVE-2021-25477

CVE-2021-25477 affects Mediatek RRC Protocol stack; improper error handling could cause a modem crash and remote DoS. Root cause described as error handling weakness in the Mediatek RRC stack prior to SMR Oct-2021 Release 1. Documented impact is network-exposed denial of service with potential av...

CVE-2022-20175

CVE-2022-20175 is documented in the Pixel security bulletin under the Modem component, with Android bug ID A-209252491. It is classified as Information Disclosure (Type: ID) and rated Moderate; no exploit details are provided in the connected documents. The Pixel bulletin notes the patch level 20...

CVE-2022-20195

CVE-2022-20195 concerns the Android keystore library with an insecure deserialization flaw that can cause local denial of service. The description across sources notes the issue allows DoS with user interaction and affects Android 12L; exploitation requires user interaction while the Pixel bullet...

CVE-2022-20365

CVE-2022-20365 affects the Android kernel (Pixel device context) and is labeled Elevation of Privilege (EoP) in userland. The CVE entry is listed under Pixel Update Bulletin security patches, with the issue categorized as Moderate severity for the affected kernel component, and a patch level of 2...

CVE-2022-20366

CVE-2022-20366 affects the Android kernel component lwis_ioctl.c, in ioctl_dpm_clk_update, where an integer overflow can cause an out-of-bounds write. This is described as enabling local privilege escalation to SYSTEM level with no user interaction required. The vulnerability is documented across...

CVE-2022-20460

CVE-2022-20460 affects the Android kernel (mprot_unmap) where improper input validation could corrupt the memory mapping. The consequence is local escalation of privilege, requiring System execution privileges, with no user interaction needed. The description appears across multiple sources (e.g....

CVE-2022-20514

CVE-2022-20514 affects Android 13 and is tied to the Idmap2Service.cpp code path. The issue is an out-of-bounds write caused by a use-after-free in acquireFabricatedOverlayIterator, nextFabricatedOverlayInfos, and releaseFabricatedOverlayIterator, which could enable local escalation of privilege ...

CVE-2022-20530

CVE-2022-20530 affects Android 13, where a vulnerability in the strings.xml resource can bypass a permission and potentially disclose call logs remotely without extra execution privileges. The issue is described as a permission bypass with remote information disclosure and no user interaction req...

CVE-2022-20607

CVE-2022-20607 affects Google Pixel devices via the Pixel cellular firmware. The issue is a missing bounds check that enables an out-of-bounds write, which could lead to remote code execution without user interaction, contingent on LTE authentication being present. The vulnerability is described ...

CVE-2022-21754

CVE-2022-21754 affects MediaTek WLAN driver and is caused by a missing bounds check that enables an out-of-bounds write. This can lead to local escalation of privilege with System execution privileges required and no user interaction needed. The remediation referenced is Patch ID ALPS06535953 / I...

CVE-2022-25821

CVE-2022-25821 affects Samsung’s Shannon baseband (SMS handling). The vulnerability arises from improper use of the SMS buffer pointer, enabling an out-of-bounds read. Public sources describe impact as read access to memory due to buffer mismanagement in Shannon baseband prior to SMR Mar-2022 Rel...

CVE-2022-47337

CVE-2022-47337 affects the media service and is caused by a missing permission check, enabling local denial of service. The description consistently states a local DoS risk but does not provide exploit details, affected versions, or a verified patch within the supplied documents. Red Hat, NVD, an...

CVE-2023-21164

CVE-2023-21164 affects the DevmemIntMapPMR code path in devicemem_server.c within the PowerVR GPU driver stack on Android/ChromeOS. The issue is a use-after-free that can lead to arbitrary code execution and local escalation of privileges in the kernel, with no additional execution privileges or ...

CVE-2023-32872

The CVE-2023-32872 issue is in MediaTek’s keyInstall module. It describes an out-of-bounds write caused by a missing bounds check, potentially enabling local privilege escalation to SYSTEM with no user interaction required. Public references in the connected documents consistently state this as a...

CVE-2023-35663

CVE-2023-35663 describes a vulnerability in Init of protocolnetadapter.cpp where a missing bounds check may cause an out-of-bounds read. This can lead to remote information disclosure without requiring user interaction, per the provided description. The affected software/component is tied to Andr...

CVE-2023-48349

CVE-2023-48349 affects a video decoder in Android components (Unisoc subcomponent) with a root cause of a missing bounds check that allows an out-of-bounds write. This could lead to local denial of service without extra privileges. Public details in connected docs are limited to the generic descr...

CVE-2024-27209

CVE-2024-27209 corresponds to a local elevation-of-privilege issue described as a possible out-of-bounds write caused by a heap buffer overflow. Public sources indicate this vulnerability affects Google Pixel/Android modem components and can be exploited with no user interaction to achieve privil...

CVE-2024-29749

CVE-2024-29749 affects the tmu_set_tr_thresholds function in tmu.c, with a missing bounds check causing a possible out-of-bounds write. This can lead to local elevation of privilege without extra execution privileges and without user interaction. Public sources repeatedly describe the issue in th...

CVE-2024-32915

The CVE-2024-32915 entry describes an out-of-bounds read in CellInfoListParserV2::FillCellInfo() within protocolnetadapter.cpp due to a missing bounds check, causing potential local information disclosure and requiring baseband firmware compromise for exploitation. Affected component: CellInfoLis...

CVE-2024-34725

The CVE-2024-34725 entry describes a race condition in DevmemIntUnexportCtx of devicemem_server.c that can allow arbitrary code execution and local privilege escalation in the kernel, with no extra privileges or user interaction required. Connected records (Red Hat, NVD, CVE lists, OSV) confirm t...

CVE-2015-9004

CVE-2015-9004 affects the Linux kernel up to version 3.18 (pre-3.19). The flaw is in kernel/events/core.c where improper handling of counter grouping enables local privilege escalation via crafted apps, involving perf_pmu_register and perf_event_open. The impact is local Privilege Escalation with...

CVE-2017-0737

The CVE-2017-0737 entry describes an elevation of privilege in Android's media framework (libstagefright) affecting Android versions 4.4.4 through 7.1.2. The vulnerability lies in the media framework and could allow a local attacker to execute code with elevated privileges in a privileged process...

CVE-2018-9445

CVE-2018-9445 describes a path traversal/privilege escalation chain in Android. The root issue: readMetadata in Utils.cpp can be fed a crafted label via blkid output that Vold uses to build a mount path, allowing a USB mass storage device to influence the path used for mounting (UUID/TYPE) and en...

CVE-2020-0231

CVE-2020-0231 is a MediaTek External Memory Interface elevation-of-privilege vulnerability in Android. The issue is an out-of-bounds write caused by an incorrect bounds check; it is listed with high to critical impact (CVSS v3.1: 9.8) and affects Android devices with the MTK External Memory Inter...

CVE-2021-0527

CVE-2021-0527 concerns a memory management driver issue where a use-after-free can cause memory corruption, enabling local privilege escalation without additional privileges. The vulnerability is described across multiple sources as affecting Android devices with MediaTek memory management driver...

CVE-2021-39741

CVE-2021-39741 affects the Android Keymaster component on Android 12L, with an out-of-bounds write caused by a missing bounds check. This leads to local elevation of privilege with System execution privileges required; no user interaction is needed. The issue is listed in Android 12L security rel...

CVE-2022-20034

CVE-2022-20034 refers to a vulnerability in Preloader XFLASH on MediaTek devices caused by improper certificate validation, enabling local privilege escalation if an attacker has physical access and no extra privileges or user interaction are required. Connected documents corroborate the issue as...

CVE-2022-20050

The CVE-2022-20050 entry refers to a vulnerability in connsyslogger where improper link resolution enables symbolic link following, leading to local escalation of privilege with System execution privileges required. Exploitation is described as local with no user interaction needed. Affected comp...

CVE-2022-20146

CVE-2022-20146 affects Android via the information disclosure in the uploadFile function of FileUploadServiceImpl.java, caused by a confused deputy that can expose private files locally without extra privileges. Exploitation is local and does not require user interaction. Public details in the co...

CVE-2022-20173

Technical details about CVE-2022-20173 are not provided in the supplied documents. No specifics on affected components or impact. Monitor for updates.

CVE-2022-20603

CVE-2022-20603 affects the Android kernel: a possible out-of-bounds write in SetDecompContextDb (RohcDeCompContextOfRbId.cpp) due to a missing bounds check. This could enable remote code execution with System privileges, with no user interaction required. Connected sources (NVD, Red Hat, PRION, O...

CVE-2022-42508

CVE-2022-42508 affects Android kernel components via ProtocolCallBuilder::BuildSendUssd, where a missing bounds check enables an out-of-bounds write. This can lead to local elevation of privilege with SYSTEMExecution privileges required; exploitation does not require user interaction. The availab...

CVE-2022-42528

CVE-2022-42528 affects Android kernel (ffa_mrd_prot in shared_mem.c). A logic error can cause local information disclosure without additional privileges, with no user interaction required. The vulnerability is documented across multiple sources (Android Pixel kernel context, Red Hat/GNU reference...

CVE-2022-42535

CVE-2022-42535 affects Android 13 (Pixel devices mentioned). Description: In MmsSmsProvider.java, there is potential access to restricted tables due to SQL injection, leading to local information disclosure. Exploitation requires local access with low privileges; user interaction is not required....

CVE-2022-48392

CVE-2022-48392 affects Unisoc chipsets via the Android dialer service, where a missing permission check can enable local escalation of privilege without requiring extra execution privileges. The CVSS v3.1 vector is LV, LO, PRL, UI N, S U, C H, I H, A H, with a base score of 7.8 (HIGH). Affected i...

CVE-2023-20844

CVE-2023-20844 affects the imgsys_cmdq component in MediaTek devices. The issue is an out-of-bounds read caused by missing valid range checking, potentially enabling local information disclosure with system-execution privileges required. Exploitation requires user interaction. The vulnerability i...

CVE-2023-20994

CVE-2023-20994 affects Android 13 via an out-of-bounds write in the function _ufdt_output_property_to_fdt in ufdt_convert.c. The vulnerability stems from an incorrect bounds check, enabling a local escalation of privilege with System execution privileges required and no user interaction. The avai...

CVE-2023-21217

CVE-2023-21217 is associated with Google Android, affecting the PowerVR-GPU driver. The vulnerability arises in the function PMRWritePMPageList() and is described as a possible out-of-bounds write caused by an integer overflow . The impact is a local escalation of privilege with no additional exe...

CVE-2023-32812

CVE-2023-32812 affects the gnss service in MediaTek contexts, with an out-of-bounds write caused by improper input validation. The resulting impact is local privilege escalation with SYSTEM privileges needed, and exploitation requires no user interaction. A patch is noted (ALPS08017365 / ALPS0801...

CVE-2024-27222

CVE-2024-27222 affects Google Pixel Android components, specifically the FaceEnrollFoldPage.java onSkipButtonClick path. The issue is described as an Intent Redirect GRANT_URI_PERMISSIONS attack that could let a local attacker access a file the app cannot access, enabling local elevation of privi...

CVE-2024-32897

CVE-2024-32897 involves an out-of-bounds read in ProtocolCdmaCallWaitingIndAdapter::GetCwInfo() within protocolsmsadapter.cpp. The issue arises from a missing bounds check, enabling a possible information disclosure; exploitability is network-based with no user interaction and could lead to baseb...

CVE-2015-5310

CVE-2015-5310 affects wpa_supplicant 2.x prior to 2.6. The WNM Sleep Mode code does not properly ignore key data in response frames when MFP was not negotiated, allowing remote attackers to inject arbitrary broadcast or multicast packets or cause a denial of service via a WNM Sleep Mode response....