CVE-2022-27821

CVE-2022-27821 concerns the Quram Agif library prior to Samsung SMR Apr-2022 Release 1, where an improper boundary check enables denial of service when processing a crafted image file. Multiple sources (Red Hat, NVD, CNVD, CVE listings) describe the issue consistently as a boundary-checking flaw ...

CVE-2022-20250

CVE-2022-20250 affects the Android 13 Messaging component. The issue stems from improper input validation that lets an attacker attach files to a message without proper access checks, enabling local elevation of privilege. Exploitation requires user interaction, and the CVSS 3.1 vector indicates ...

CVE-2022-47358

Technical details about CVE-2022-47358 are not publicly provided in the supplied documents; no affected products/versions are specified here. Monitor for updates in connected sources.

CVE-2023-21009

CVE-2023-21009 describes an out-of-bounds read in Android’s p2p_iface.cpp caused by a missing bounds check. Affects Android-13 devices; impact is local information disclosure with system-level privileges required. Exploitation does not require user interaction. The issue is listed in the Pixel se...

CVE-2017-0745

CVE-2017-0745 is a remote code execution vulnerability in the Android media framework, specifically the avc decoder. Affected Android versions include 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, and 7.1.2. The connected documents consistently describe the issue as a media-framework fault enablin...

CVE-2017-0813

Summary of CVE-2017-0813 : A denial-of-service vulnerability exists in the Android media framework (libstagefright) affecting Android versions 7.0, 7.1.1, and 7.1.2. The issue is identified as a DoS in the Media framework component; the provided documents do not specify the root cause details bey...

CVE-2017-0834

CVE-2017-0834 is a remote code execution vulnerability in Android’s media framework (libmpeg2) affecting Android versions 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, and 8.0 (Android ID: A-63125953). The connected documents corroborate RCE in the Media Framework and list the affected versions; no explicit exp...

CVE-2017-13208

CVE-2017-13208 affects Android via libnetutils/packet.c receive_packet, enabling a possible remote code execution through an out-of-bounds write on DHCP responses. Impacted Android versions: 5.1.1–8.1. Vector: network; no user interaction required; no additional privileges needed. The Android Sec...

CVE-2017-13211

CVE-2017-13211 affects Android 8.0. The issue is in btif_ble_scanner.cc (function bta_scan_results_cb_impl) where a flood of repeated BLE scan results can exhaust resources, enabling remote DoS of a critical system process with no privileges and no user interaction. The Android bulletin notes tha...

CVE-2017-13323

CVE-2017-13323 is a Google/Android elevation-of-privilege flaw caused by an out-of-bounds write in String16.cpp due to an integer overflow. The Red Hat and CNVD entries restate the issue; Android/Pixel bulletin notes this CVE as EoP (Moderate) and indicates patches are included in the 2018-05-05 ...

CVE-2019-9421

CVE-2019-9421 affects the Android framework library libandroidfw, with an out-of-bounds read caused by an integer overflow . The issue enables a potential local information disclosure vulnerability and, per the sources, requires some user interaction to exploit. The vulnerability entry lists affe...

CVE-2020-26606

CVE-2020-26606 affects Samsung mobile devices running O(8.x) through R(11.0). The issue allows an attacker to access Secure Folder content via a debugging command. The NVD entry cites CVSS 3.1 base score 7.5 (High) with Network attack vector and no privileges required; confidentiality impact High...

CVE-2021-0534

CVE-2021-0534 affects Android 11, stemming from an insecure default in DeviceAdminReceiver.java permission declarations, which can allow local privilege escalation without extra privileges or user interaction. The issue’s root cause is lack of broadcast protection due to insufficient default prot...

CVE-2021-0567

CVE-2021-0567 affects Android 11, where isRestricted in RemoteViews.java can be bypassed to inject font files, enabling local escalation of privilege with no additional privileges or user interaction. The vulnerability is categorized as Elevation of Privilege (EoP). In public advisories, patches ...

CVE-2021-0997

CVE-2021-0997 affects Android 12; the issue is in GnssNetworkConnectivityHandler.java (handleUpdateNetworkState) where a log information disclosure enables local information disclosure with no extra privileges and without user interaction. Exploitation requires local access; impact is confidentia...

CVE-2021-1008

CVE-2021-1008 affects Android 12; the issue is in addSubInfo of SubscriptionController.java, described as a logic error that could force a factory reset, yielding local denial of service with system privileges. Exploitation is stated as possible without user interaction. Connected documents corro...

CVE-2021-25365

CVE-2021-25365 concerns an improper exception control in the Samsung softsimd component prior to SMR APR-2021 Release 1. The vulnerability allows unprivileged applications to access the softsimd API. The entry is tied to Samsung SMR APR-2021 Release 1, indicating a patch/maintenance release in th...

CVE-2021-27901

Summary (CVE-2021-27901) : Affects LG mobile devices running Android 11. The vulnerability arises from mishandling of fingerprint recognition when Local High Beam Mode (LHBM) does not function properly under bright illumination, as identified by LG under ID LVE-SMP-210001 (March 2021). The issue ...

CVE-2021-39651

Technical details are not publicly available in the provided documents for CVE-2021-39651; the connected sources describe a placeholder TBD vulnerability without concrete affected products or fixes. Monitor for updates as information remains unavailable.

CVE-2022-20248

CVE-2022-20248 affects Android 13 where a logic error in the Settings code can bypass DISALLOW_CONFIG_WIFI, enabling a local escalation of privilege to connect to an open network without user interaction. Affected component: Settings; impact: local Privilege Elevation with High confidentiality/in...

CVE-2022-20258

CVE-2022-20258 affects Android 13 Bluetooth. The issue stems from a configuration error that allows bypassing compiler exploit mitigations, enabling local escalation of privilege with no additional execution privileges required and no user interaction. Impact is limited to devices where Bluetooth...

CVE-2022-20553

CVE-2022-20553 affects Android 13 where an overlay tapjacking in onCreate of LogAccessDialogActivity.java can bypass a permission check, enabling local elevation of privilege with system execution privileges. Exploitation requires user interaction and is described as LOCAL with HIGH confidentiali...

CVE-2022-21757

CVE-2022-21757 affects the WIFI firmware (noted in MediaTek context) with a missing count check that can cause a system crash, enabling remote denial of service without required privileges or user interaction. The entry lists a patch ID ALPS06468894 / issue ALPS06468894 as the remediation. No fur...

CVE-2022-21772

The CVE-2022-21772 entry concerns the TEEI driver, where a race condition can cause type confusion and lead to local escalation of privileges with System rights, requiring no user interaction. The vulnerability context and impact are documented across multiple sources (NVD, Red Hat, PRION, CVE li...

CVE-2022-21775

CVE-2022-21775 affects MediaTek’s sched driver. The issue is a use-after-free caused by improper locking, enabling local escalation of privileges with System privileges required; user interaction is not needed for exploitation. Affected component: sched driver; root cause: improper locking leadin...

CVE-2022-23425

CVE-2022-23425 describes an input validation flaw in the Exynos baseband prior to Samsung SMR Feb-2022 Release 1, allowing an attacker to send arbitrary NAS signaling messages using a fake base station. Affected component: Exynos baseband; issue stems from improper input validation. Impact is des...

CVE-2022-27569

CVE-2022-27569 is a heap-based buffer overflow in the parser_infe function of the libsimba library, exploitable remotely to achieve code execution. The condition is with software versions prior to SMR Apr-2022 Release 1 . Affected component: libsimba parser_infe; root cause: heap overflow. Impact...

CVE-2022-27827

The CVE-2022-27827 entry concerns an improper validation vulnerability in MediaMonitorDimension, prior to Samsung SMR Apr-2022 Release 1. Affected item appears to be the MediaMonitorDimension component (in Samsung context) where input validation fails, enabling attackers to launch certain activit...

CVE-2022-30713

CVE-2022-30713 concerns a vulnerability in Samsung/LSOItemData, where improper validation (and lack of proper authentication logic per CNVD) may allow a local attacker to elevate privileges and initiate certain activities on affected Samsung mobile devices. Evidence across sources indicates the i...

CVE-2022-30727

CVE-2022-30727 affects Samsung Mobile’s PersonaManagerService, due to improper handling of permissions in addAppPackageNameToAllowList. The issue allows a local attacker to set certain workspace settings. Root cause: permission management weakness in PersonaManagerService prior to the SMR Jun-202...

CVE-2022-32592

The CVE-2022-32592 entry concerns MediaTek chipsets with a flaw in the cpu dvfs subsystem, where a missing bounds check enables an out-of-bounds write. This can allow local privilege escalation to SYSTEM with no user interaction required. The only remediation information present is Patch ID ALPS0...

CVE-2022-32626

CVE-2022-32626 involves an out-of-bounds write caused by an incorrect bounds check in display logic. The vulnerability is reported in MediaTek chips and could enable local escalation of privilege with SYSTEM-level execution privileges; exploitation requires no user interaction per the sources. Th...

CVE-2022-32633

CVE-2022-32633 affects MediaTek Wi‑Fi components with a logic error that can cause a memory access violation, enabling local privilege escalation without user interaction. Root cause: memory access violation in Wi‑Fi code; impact据 indicate Local, Privileges required HIGH, with System execution pr...

CVE-2022-32638

CVE-2022-32638 describes a race-condition in the ISP component allowing an out-of-bounds write that can lead to local privilege escalation with SYSTEM privileges; exploitation reportedly requires no user interaction. A patch is referenced (ALPS07494449/ALPS07494449). Some connected sources attrib...

CVE-2022-33699

CVE-2022-33699 affects Samsung TelephonyUI’s getDsaSimImsi, where IMSI can be disclosed through logs due to insufficient protection in TelephonyUI. The issue is a local disclosure vulnerability, enabling a local attacker to access IMSI data. Affected component is Samsung TelephonyUI prior to SMR ...

CVE-2022-33725

The CVE-2022-33725 issue affects Samsung Knox VPN, where a flaw in PendingIntent usage could allow a local attacker to access a content provider with system privileges. Root cause: improper PendingIntent handling within Knox VPN prior to SMR Aug-2022 Release 1. Impact per sources: potential media...

CVE-2022-38682

CVE-2022-38682 affects the contacts service, where a missing permission check could allow a local denial of service without requiring additional privileges. The Red Hat, NVD, CNNVD, and other connected records corroborate the same description; no explicit exploitation details, affected software v...

CVE-2022-38686

The documents confirm a vulnerability in the wlan driver caused by a missing parameter check, enabling local denial of service in wlan services. Affected component: wlan driver (no specific vendor or version provided in the sources). Root cause: insufficient input validation leading to a service ...

CVE-2022-47367

The CVE-2022-47367 entry concerns a missing permission check in the Bluetooth driver, enabling local information disclosure without additional execution privileges. Affected component: Bluetooth driver (no vendor/product/version details provided). Root cause: insufficient permission verification ...

CVE-2022-47482

CVE-2022-47482 involves a missing permission check in the telephony service, enabling a local denial of service without additional execution privileges. The NVD listing specifies a CVSS v3.1 base score of 5.5 (Medium), with local attack vector, low attack complexity and privileges required, and a...

CVE-2023-20606

CVE-2023-20606 describes an out-of-bounds read in the apusys component due to a missing bounds check, potentially allowing local information disclosure with SYSTEM privileges. Exploitation is reported to not require user interaction. A patch is available (ALPS07571104; Issue ID ALPS07571104). Con...

CVE-2023-20729

CVE-2023-20729 reflects a WLAN module issue in MediaTek chips where a missing bounds check enables an out-of-bounds read. The vulnerability could lead to local information disclosure, with execution privileges required and no user interaction needed. Documented impact is limited to information di...

CVE-2023-20847

CVE-2023-20847 affects MediaTek chips, specifically the imgsys_cmdq component, where a missing valid range check can cause an out-of-bounds read. This vulnerability can lead to local denial of service with SYSTEM privileges required, and exploitation requires user interaction. The known remedy in...

CVE-2023-20925

CVE-2023-20925 affects the Android kernel, specifically the use-after-free in the PowerSessionManager.cpp function setUclampMinLocked. This memory corruption can lead to local escalation of privilege without extra execution privileges and requires local access, with no user interaction needed. Th...

CVE-2023-21211

CVE-2023-21211 affects Android 13 and is described across multiple sources as a vulnerability in multiple files that enables an out-of-bounds read caused by a heap buffer overflow. The impact is local information disclosure with no additional execution privileges required, and exploitation does n...

CVE-2023-21392

CVE-2023-21392 concerns a memory corruption vulnerability in Bluetooth, caused by a use-after-free in the Bluetooth stack that can enable local privilege escalation when pairing/connecting to a Bluetooth device. Exploitation does not require user interaction and does not need pre-existing executi...

CVE-2023-32891

CVE-2023-32891 relates to an out-of-bounds write in the bluetooth service caused by improper input validation. Affected component is described as the Bluetooth service (no specific vendor/version in provided text beyond MediaTek-linked sources). The underlying root cause is input validation weakn...

CVE-2024-0028

In Audio Service, there is a possible way to obtain MAC addresses of nearby Bluetooth devices due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2024-20052

In flashc (MediaTek chip/software context), an uncaught exception can cause information disclosure, potentially enabling local information exposure with System privileges. Exploitation requires local access; no user interaction is needed. A patch is referenced (ALPS08541757 / ALPS08541761). No ot...

CVE-2024-44100

CVE-2024-44100 relates to information disclosure on Google Pixel devices prior to 2024-10-05, specifically in the modem component (A-299774545). The issue stems from a vulnerability in the Pixel modem that enables leakage of information, with a CVSS v3.1 base score of 7.5 (High). Affected product...