CVE-2022-32630

CVE-2022-32630 involves a vulnerability in the throttling path that can cause an out-of-bounds write due to an incorrect calculation of buffer size. The available connected sources indicate this affects MediaTek chips (throttling component) and can lead to local escalation of privilege with Syste...

CVE-2022-33690

The CVE-2022-33690 issue concerns Samsung Contacts Storage on Samsung mobile devices, due to improper input validation that enables path traversal. The vulnerability allows an attacker to access arbitrary files via the Contacts Storage component prior to the SMR July 2022 Release 1. Documented im...

CVE-2023-20604

The CVE-2023-20604 issue affects the MediaTek ged component. It describes an out-of-bounds write caused by a missing bounds check, enabling local escalation of privilege with SYSTEM privileges required; exploitation is not dependent on user interaction. The patch ID provided is ALPS07494067 (Issu...

CVE-2023-20716

CVE-2023-20716 concerns the wlan component in MediaTek chips, where an out-of-bounds write occurs due to a missing bounds check in the WLAN driver. This can lead to local escalation of privileges with System execution rights, and no user interaction is required. Reported patch: ALPS07796883 (Issu...

CVE-2023-20731

CVE-2023-20731 affects the MediaTek WLAN component. The root cause is a missing bounds check that enables an out-of-bounds read, leading to local information disclosure with System execution privileges required. User interaction is not needed. Patch ID ALPS07573495 (Issue ALPS07573495) is listed ...

CVE-2023-20739

The CVE-2023-20739 issue affects the vcu component in MediaTek chips. It describes a memory corruption resulting from a logic error, enabling local escalation of privilege with SYSTEM execution privileges, without user interaction. Reported patch ID: ALPS07559819 (Issue ALPS07559819). Connected s...

CVE-2023-20810

CVE-2023-20810 affects the IOMMU component in MediaTek platforms. Root cause: improper input validation in the IOMMU leading to potential local information disclosure with required system execution privileges. Exploitation described as local, with no user interaction needed. Impact per documents:...

CVE-2023-20839

CVE-2023-20839 affects the imgsys component. The root cause is an out-of-bounds read due to missing valid range checking, leading to local information disclosure with system execution privileges required and user interaction for exploitation. The vulnerability is documented across multiple source...

CVE-2023-20973

CVE-2023-20973 affects Android 13, specifically the Bluetooth stack: in btm_create_conn_cancel_complete() of btm_sec.cc, a missing bounds check enables an out-of-bounds read. This can lead to local information disclosure with SYSTEM-level privileges needed; exploitation reportedly does not requir...

CVE-2023-21006

CVE-2023-21006 affects Google Pixel/Android 13 where a missing bounds check in the p2p_iface.cpp file allows an out-of-bounds read, leading to local information disclosure with System privileges required. No user interaction is needed. Remediation: apply Android security updates; Pixel bulletin i...

CVE-2023-21028

CVE-2023-21028 affects Android 13 and is tied to ipphelper.c in parse_printerAttributes, where an out-of-bounds read can occur from a string not terminated with a null character. This leads to remote information disclosure without additional execution privileges and does not require user interact...

CVE-2023-21043

CVE-2023-21043 affects Android kernel components with memory corruption via a use-after-free, enabling local escalation to System privileges. Exploitation details, affected versions, and patch status are not provided in the connected documents; the description remains TBD. If pursuing remediation...

CVE-2023-21181

CVE-2023-21181: In btm_ble_update_inq_result in btm_ble_gap.cc (Android 13) there is a possible out-of-bounds read due to a heap buffer overflow, potentially enabling local information disclosure with system privileges. Exploitation does not require user interaction. Affected product/version: And...

CVE-2023-21195

CVE-2023-21195 concerns Android 13 devices. The issue is in the Bluetooth stack: function btm_ble_periodic_adv_sync_tx_rcvd in btm_ble_gap.cc may perform an out-of-bounds read due to an incorrect bounds check. This could allow local information disclosure over Bluetooth if the device firmware is ...

CVE-2023-21202

CVE-2023-21202 affects Android 13 Bluetooth stack as described in the Android CVE entry. The issue is located in the function btm_delete_stored_link_key_complete in btm_devctl.cc , where a missing bounds check can cause an out-of-bounds read. This can lead to local information disclosure over Blu...

CVE-2023-21222

CVE-2023-21222 : In the Android kernel, the vulnerability is in the function that parses device tree data (storage.c: load_dt_data). A missing bounds check can trigger an out-of-bounds write, enabling local escalation of privilege with System execution privileges required. User interaction is not...

CVE-2023-21375

CVE-2023-21375 affects Sysproxy with an out-of-bounds write caused by an integer underflow. The vulnerability enables local privilege escalation without extra execution privileges and does not require user interaction. Public documentation reports this issue but provides no concrete exploit detai...

CVE-2024-20002

CVE-2024-20002 affects TVAPI with an out-of-bounds write caused by a missing bounds check. The vulnerability allows local escalation to SYSTEM with no user interaction required, as indicated by both NVD and Red Hat entries. The impact is limited to local privilege escalation with high confidentia...

CVE-2024-20037

In pq, there is a possible write-what-where condition due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08495937; Issue ID: ALPS08495937.

CVE-2024-20041

The CVE-2024-20041 entry affects MediaTek devices (da module) and is due to a missing bounds check causing an out-of-bounds read. This can lead to local information disclosure with System execution privileges needed; no user interaction is required. The public records cite Patch ID ALPS08541746 (...

CVE-2024-49740

In multiple locations, there is a possible crash loop due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2014-0997

CVE-2014-0997 affects Android devices using WiFiMonitor handling for Wi-Fi Direct. A crafted 802.11 Probe Response frame can trigger an uncaught IllegalArgumentException in WifiMonitor/WifiP2pDevice, causing the Dalvik subsystem to reboot and resulting in a denial of service. Vulnerable on severa...

CVE-2015-3826

The CVE-2015-3826 issue affects Android’s media stack in libstagefright (MPEG4Extractor.cpp) where MPEG4Extractor::parse3GPPMetaData does not enforce a minimum size for UTF-16 BOM strings. This can enable a remote attacker to trigger a crash in mediaserver via crafted 3GPP metadata (integer under...

CVE-2015-3860

CVE-2015-3860 is a Lockscreen elevation-of-privilege flaw in Android 5.0/5.1 (build LMY48M) where the passwordEntry field in Keyguard does not cap input length, enabling a physical attacker to crash SystemUI and bypass the lock screen. Affected versions include Android 5.0 and 5.1 up to 5.1.0; Go...

CVE-2015-6616

CVE-2015-6616 is a memory-corruption vulnerability in Android’s mediaserver. It affects Android versions prior to 5.1.1 LMY48Z and 6.0 prior to 2015-12-01, allowing remote attackers to execute arbitrary code or cause a denial of service via a crafted media file (internal bugs 24630158 and 2388280...

CVE-2016-10275

CVE-2016-10275 is an elevation-of-privilege vulnerability in the Qualcomm bootloader that could allow a local malicious Android app to execute arbitrary code in the kernel context. Public documentation ties this to Qualcomm bootloader flaws and Android patch coverage. The Android May 2017 bulleti...

CVE-2017-0467

CVE-2017-0467 describes a remote code execution vulnerability in Android’s Mediaserver. An attacker could exploit memory corruption during media file and data processing by using a specially crafted file, enabling code execution within the Mediaserver process. Affected versions are Android 6.0–7....

CVE-2017-0642

CVE-2017-0642 describes a remote denial-of-service in libhevc within Mediaserver on Android. The vulnerability can be triggered by processing a specially crafted media file, potentially causing the device to hang or reboot. Affected Android versions are 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, and 7...

CVE-2017-0644

CVE-2017-0644 is an Android Mediaserver/Media framework DoS vulnerability. A specially crafted file could cause a device hang or reboot, enabling remote denial of service. Affected products/versions include Android 4.4.4–6.0.1. The issue is listed under the Android 2017-06-01 and 2017-06-05 patch...

CVE-2017-0795

CVE-2017-0795 is a privilege-escalation vulnerability in the MediaTek accessory detector driver within the Android kernel. The issue is categorized as an EoP with high impact locally (no user interaction required in some contexts, per CVSS data). Affected component: MediaTek accessory detector dr...

CVE-2017-13252

The CVE (CVE-2017-13252) affects Android 8.0 and 8.1 via CryptoHal::decrypt in CryptoHal.cpp, where improper input validation causes an out-of-bounds write and a read from uninitialized memory. This yields local elevation of privilege with no extra execution privileges required, and exploitation ...

CVE-2017-13280

CVE-2017-13280 affects the Android/libframesequence library, specifically the FrameSequence_gif function. The issue is an out-of-bounds read due to a missing bounds check, leading to a remote DoS without user interaction. Affected Android versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. The vul...

CVE-2018-9372

CVE-2018-9372 : The issue is in the Android bootloader path (cmd_flash_mmc_sparse_img in dl_commands.c) where there is a possible out-of-bounds write caused by a missing bounds check. This could allow a local escalation of privilege in the bootloader without additional execution privileges and wi...

CVE-2018-9396

CVE-2018-9396 affects the Mediatek port_rpc.c code path (drivers/misc/mediatek/eccci/port_rpc.c) where an incorrect bounds check enables an out-of-bounds write. This can lead to local escalation of privilege with SYSTEM execution privileges needed, and exploitation does not require user interacti...

CVE-2018-9418

CVE-2018-9418 involves a possible stack buffer overflow in the Android kernel/user-space component described as dtif_rc.cc:handle_app_cur_val_response, caused by a missing bounds check. The Red Hat/NVD/CVE records align with the Android Pixel/Nexus security bulletin noting this issue as a Remote ...

CVE-2019-2043

CVE-2019-2043 describes a local elevation-of-privilege in Android’s SmsDefaultDialog.onStart due to an overlay attack. The vulnerability could allow a malicious local app to gain privileges without extra user consent, with user interaction required for exploitation and impact on Android 7.0–9. Th...

CVE-2019-9259

CVE-2019-9259 affects the Android 10 Bluetooth stack, where a use-after-free leads to an out-of-bounds write. This could allow local elevation of privilege to SYSTEM with no user interaction. Exploitation status is not detailed in the provided docs. Remediation is addressed in Android 10 security...

CVE-2019-9281

CVE-2019-9281 affects GoogleContactsSyncAdapter in Android 10. The issue is a path traversal vulnerability caused by improper input sanitization, enabling a bypass of user interaction requirements without extra execution privileges. Impact is described as allowing access outside restricted direct...

CVE-2019-9297

CVE-2019-9297 affects Android 10, within the Android Media Framework (libAACdec). The issue is a potential out-of-bounds write caused by an integer overflow in a decoder component, which could enable remote code execution. Exploitation requires user interaction, and successful exploitation would ...

CVE-2020-0084

CVE-2020-0084 affects Android 10, where several functions in NotificationManagerService.java lack permission checks. This enables local escalation of privilege by creating fake system notifications with no extra privileges, and exploitation does not require user interaction. The Pixel Update Bull...

CVE-2020-0085

CVE-2020-0085 affects Android 10 where an issue in PanService.java: setBluetoothTethering can bypass a permission check, enabling local escalation of privilege to activate tethering without extra execution privileges. The vulnerability is local, requires no user interaction, and could grant eleva...

CVE-2020-12753

Summary (CVE-2020-12753): LG mobile devices running Android 7.2–10 are affected by an EL1/EL3 coldboot vulnerability in the bootloader affecting the raw_resources partition, enabling arbitrary code execution. The issue is identified as LG internal tag LVE-SMP-200006 (May 2020). Public sources in ...

CVE-2021-0554

CVE-2021-0554 affects Android 11, where isBackupServiceActive in BackupManagerService.java lacks a required permission check, enabling local information disclosure without user interaction. Documented risk: local disclosure with no privileges beyond local access; attack complexity LOW. Remediatio...

CVE-2021-0985

CVE-2021-0985 affects Android 12 via AlertReceiver.java (onReceive). A missing permission check could allow dismissing a system dialog, enabling local privilege escalation without extra execution privileges or user interaction. The Pixel bulletin lists this under Framework with updated AOSP patch...

CVE-2021-1009

CVE-2021-1009 affects Android 12 and is described as a local information disclosure through the PackageManagerService.setApplicationCategoryHint, enabling an attacker to determine whether an app is installed without any query permissions. The vulnerability arises from a side-channel information d...

CVE-2021-1011

CVE-2021-1011 affects Android 12 via a missing permission check in PackageManagerService.java during setPackageStoppedState, enabling local information disclosure without additional execution privileges. The issue allows disclosure of information to an attacker with local access and does not requ...

CVE-2021-1022

CVE-2021-1022 : In Android 12, a missing null check in btif_in_hf_client_generic_evt (btif_hf_client.cc) can cause a Bluetooth service crash, enabling a remote DoS without user interaction. The issue is tied to the Bluetooth Hands-Free Profile client, with impact described as remote denial of ser...

CVE-2021-1043

CVE-2021-1043 affects Google Pixel devices (Pixel/Titan-M) as documented in the Pixel Update Bulletin. The issue is described as a downgrade attack due to under-utilized anti-rollback protections, enabling local information disclosure without additional execution privileges. Affected component: T...

CVE-2021-39637

The CVE-2021-39637 entry describes an out-of-bounds read in CreateDeviceInfo of trusty_remote_provisioning_context.cpp due to a missing bounds check. This vulnerability could allow local information disclosure with system privileges required, and is exploitable without user interaction. Affected ...

CVE-2021-39647

CVE-2021-39647 concerns the Samsung Exynos 9845-based GS101/boot path where in mon_smc_load_sp of gs101-sc/plat/samsung/exynos/soc/exynos9845/smc_booting.S there is a likely reinitialization of the Trusted Execution Environment due to improper locking. This can enable local information disclosure...