CVE-2017-0814

CVE-2017-0814 is an information-disclosure vulnerability in the Android media framework. The Pixel/Nexus bulletin lists this CVE under the Media framework component with a mitigation path via security patches at the 2017-10-05 patch level, addressing devices updated to Android 7.0, 7.1.1, 7.1.2, ...

CVE-2019-9298

CVE-2019-9298 affects Android 10 in the Media Framework (libAACdec). A vulnerability in the library allows an out-of-bounds write caused by an integer overflow, potentially enabling remote code execution. Exploitation requires user interaction. The issue is categorized as RCE with impact to confi...

CVE-2017-0418

CVE-2017-0418 is an elevation of privilege in Android’s Audioserver that could allow a local malicious application to run arbitrary code in the context of a privileged process. Affected products are Android versions 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, and 7.1.1. The provided documents consisten...

CVE-2017-0466

CVE-2017-0466 is a remote code execution vulnerability in Android’s Mediaserver. A specially crafted file could trigger memory corruption during media file and data processing, allowing an attacker to execute code within the Mediaserver process. Affected products/versions are Android 6.0, 6.0.1, ...

CVE-2017-0486

CVE-2017-0486 describes a denial-of-service vulnerability in Android’s Mediaserver. A specially crafted file could cause a device Hang or Reboot on affected Android versions (6.0, 6.0.1, 7.0, 7.1.1). The issue is described as High severity; attack vector is listed as Local (per CVSS3) with user i...

CVE-2017-0493

CVE-2017-0493 is an information-disclosure vulnerability in Android’s File-Based Encryption that could allow a local attacker to bypass lock-screen protections. Affected products/versions (from sources): Android 7.0 and 7.1.1. Root cause: information disclosure within File-Based Encryption (no fu...

CVE-2017-0555

CVE-2017-0555 is an information disclosure flaw in Android’s Mediaserver libavc component. The vulnerability could allow a local malicious app to access data outside its permissions by exploiting Mediaserver during media processing. Affected: Android 6.0–7.1.1 (versions 6.0, 6.0.1, 7.0, 7.1.1). R...

CVE-2017-0625

The CVE-2017-0625 entry corresponds to an information disclosure vulnerability in the MediaTek command queue driver affecting Android. Connected CNVD records describe impact as local information disclosure enabling a malicious local app to access data outside its permissions, with Android version...

CVE-2017-0646

CVE-2017-0646 is an information-disclosure vulnerability in the Android Bluetooth component that could allow a local malicious app to access data beyond its permissions. Affected Android versions include 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, and 7.1.2 (Android ID A-33899337). The connected...

CVE-2017-0691

CVE-2017-0691 is a denial-of-service vulnerability in the Android media framework affecting Android 7.0, 7.1.1 and 7.1.2 (Android ID A-36724453). The NVD CVSS data lists a medium severity (CVSSv2: 4.3; AV:N/AC:M/Au:N/I:N/C:N/A:P) and a CVSSv3 score of 5.5 (LOCAL, UI required, high availability im...

CVE-2017-0719

CVE-2017-0719 is a remote code execution vulnerability in the Android media framework (mpeg2 decoder) affecting Android 6.0, 6.0.1, 7.0, 7.1.1, and 7.1.2. The available descriptions consistently cite RCE via the media framework’s MPEG-2 decoding path; the exact root cause is not detailed in the p...

CVE-2017-0732

CVE-2017-0732 is referenced in EulerOS security advisories as a vulnerability in OpenSSL/OpenSSL-based TLS key exchange. The connected Nessus/NASL entries describe that during TLS key exchange with a DH(E) cipher suite a server may send a very large prime, causing the client to hang while generat...

CVE-2017-0770

CVE-2017-0770 is an elevation of privilege in Android's media framework (libmediaplayerservice) affecting Android versions 4.4.4–8.0. The entry provides the vulnerable component and affected versions, plus CVSS scores (high severity). No exploit status is listed in the provided documents; the And...

CVE-2017-0777

CVE-2017-0777 is an information-disclosure vulnerability in the Android media framework affecting Android 7.0, 7.1.1 and 7.1.2. The supplied documents state an information-disclosure issue but do not specify the exact root cause, vulnerable component versioning beyond the Android OS versions, or ...

CVE-2017-0842

CVE-2017-0842 is an Elevation of Privilege vulnerability in Android Bluetooth affecting Android 6.0–8.0. The issue allows a local attacker to gain privileges within the system Bluetooth stack. Public sources classify it as EoP with HIGH severity (CVSS v3 base 7.8). The vulnerability is documented...

CVE-2017-13160

CVE-2017-13160 is a remote code execution in Android’s Bluetooth subsystem affecting Android 7.0, 7.1.1, 7.1.2 and 8.0 (Android ID A-37160362). The vulnerability is classified as RCE and received a Critical/High-severity rating in the Android bulletin, with impact described as arbitrary code exec...

CVE-2017-13196

CVE-2017-13196 affects Android’s Media Framework, caused by a dead loop in ihevcd_decode.c when processing incomplete frames. This can lead to memory leaks and a remote denial of service of a critical system process, without user interaction. Affected Android versions include 5.1.1, 6.0, 6.0.1, 7...

CVE-2017-13272

CVE-2017-13272 affects Android (7.0–8.1). The issue is an out-of-bounds write caused by a use-after-free in alarm_ready_generic (alarm.cc), enabling remote escalation of privilege with no user interaction. CVSSv3 base score 9.8 (Network, High impact on confidentiality, integrity, availability). T...

CVE-2018-5829

The CVE-2018-5829 issue affects the WLAN stack in Android for MSM CAF builds (Linux kernel) and specifically the function wlan_hdd_cfg80211_set_privacy_ibss(). The vulnerability is a buffer over-read reported in Android releases using the affected CAF Linux kernel prior to the 2018-06-05 security...

CVE-2018-9348

A denial of service vulnerability exists in the Media framework component of Google Android due to an integer overflow in SMF_ParseMetaEvent of eas_smf.c. An attacker can exploit this to cause resource exhaustion, requiring no additional execution privileges but necessitating user interaction . T...

CVE-2018-9364

CVE-2018-9364 corresponds to an Elevation of Privilege in the LG LGLAF bootloader component. The connected sources indicate the issue involves a special command that permitted modification of certain partitions, enabling bypass of secure boot. The Red Hat and Android bulletin entries corroborate ...

CVE-2018-9376

In rpc_msg_handler and related handlers of drivers/misc/mediatek/eccci/port_rpc.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

CVE-2018-9397

In WMT_unlocked_ioctl of MTK WMT device driver, there is a possible OOBwrite due to a missing bounds check. This could lead to local escalation ofprivilege with System execution privileges needed. User interaction is notneeded for exploitation.

CVE-2018-9398

A security vulnerability exists in the Mediatek FM radio driver due to improper input validation in the fm_set_stat function. This flaw can lead to an out-of-bounds (OOB) write , potentially allowing for local escalation of privilege with System execution privileges. Exploitation does not require...

CVE-2018-9470

CVE-2018-9470 : The flaw is in the function bff_Scanner_addOutPos of Scanner.c , where an incorrect bounds check may cause an out-of-bounds write. This could enable remote escalation of privilege in an unprivileged app with no additional execution privileges required, and exploitation requires us...

CVE-2018-9549

CVE-2018-9549 is a concrete Android vulnerability in the Media Framework (lppTransposer function in lpp_tran.cpp) caused by a missing bounds check that enables a remote code execution via a crafted file. It affects Android versions 7.0 (Nougat) through 9 (Pie). The Android bulletin identifies it ...

CVE-2019-2062

Summary of CVE-2019-2062 : A vulnerability in the Android 10 libxaac library allows an out-of-bounds write due to a missing bounds check. This can enable remote code execution with user interaction required for exploitation, as reported in multiple sources (NVD/Red Hat/CNVD) and reflected in Andr...

CVE-2019-2105

CVE-2019-2105 affects Android’s library component: in FileInputStream::Read of file_input_stream.cc, a memory corruption due to uninitialized data could enable remote code execution in an unprivileged process. Exploitation requires user interaction. Affected Android versions include 7.0, 7.1.1, 7...

CVE-2019-2144

CVE-2019-2144 affects libxaac in Android 10, where a missing bounds check can cause an out-of-bounds read leading to information disclosure. The vulnerability does not grant privileges and requires user interaction to exploit. Exploitation details are not provided in the supplied documents. The i...

CVE-2019-9237

CVE-2019-9237 describes a Bluetooth out-of-bounds read in Android 10 due to a missing bounds check, enabling potential remote information disclosure. Exploitation requires user interaction, and the issue does not require elevated privileges beyond what the user already has. Affected product is An...

CVE-2019-9295

CVE-2019-9295 affects com.android.apps.tag on Android 10. The vulnerability is described as a bypass of user interaction requirements due to a missing permission check, potentially enabling local escalation of privilege with user execution privileges. The exploitation note states that user intera...

CVE-2019-9337

CVE-2019-9337 affects Android 10 via the libavc component, causing information disclosure from uninitialized data. Impact: remote information disclosure without additional execution privileges, with user interaction required for exploitation. Root cause: uninitialized data in libavc. Affected pro...

CVE-2019-9410

CVE-2019-9410 affects the Android 10 libavc library, where information disclosure can occur due to uninitialized data in the media handling path. The vulnerability enables remote disclosure without additional code execution, with network as the attack surface and user interaction required for exp...

CVE-2019-9413

Summary (CVE-2019-9413) : A Bluetooth component in Android 10 contains an out-of-bounds read due to a missing bounds check, enabling remote information disclosure without extra privileges or user interaction. It is documented with CVSS vectors: CVSS v2 base score 5.0 (Medium) and CVSS v3.1 base s...

CVE-2020-0004

CVE-2020-0004 affects Android 8.0–10 in WallpaperManagerService.generateCrop, where processing an image that exceeds the maximum texture size can trigger a local DoS in the systemui. The root cause is an image-texture handling issue in WallpaperManagerService.java. The vulnerability is local and ...

CVE-2020-0049

CVE-2020-0049 affects Android 10 Media Framework (StreamingSource.cpp: onReadBuffer()) with an information disclosure due to uninitialized data. Impact: potential remote information disclosure; exploitation requires user interaction. The issue is listed under Pixel security bulletins for CVE-2020...

CVE-2020-0057

CVE-2020-0057 affects Android 10, in btm_process_inq_results (btm_inq.cc) where a missing bounds check enables an out-of-bounds read that can disclose information locally without user interaction or additional privileges. Public documentation indicates mitigation via the March 2020 Android securi...

CVE-2020-0293

CVE-2020-0293 affects Android 11 via the Java network APIs where a missing permission check can allow access to sensitive network state, leading to local information disclosure without extra execution privileges. The vulnerability is described as requiring no user interaction for exploitation and...

CVE-2020-28342

Technical details are not publicly available in the provided documents; no information on affected products, components, or fixes beyond the generic description. Monitor for updates.

CVE-2021-1046

CVE-2021-1046 affects the Android kernel, specifically the lwis_dpm_update_clock function in lwis_device_dpm.c. The issue is an out-of-bounds read caused by an incorrect bounds check, which could enable local information disclosure with System-level privileges required. Exploitation does not requ...

CVE-2021-30162

CVE-2021-30162 affects LG mobile devices running Android 4.4–11. The issue involves ISMS services allowing attackers to bypass access control for specific content providers, identified by LG as LVE-SMP-210003 (April 2021). Public details across sources describe the vulnerability and its impact bu...

CVE-2022-20336

CVE-2022-20336 concerns Android 13 where a missing permission check in Settings enables local information disclosure of installed apps allowed to use the network during VPN lockdown mode. The issue is triggered without user interaction and affects the Settings component; exploitation could reveal...

CVE-2022-20339

CVE-2022-20339 affects Android 13 and is caused by an insecure SEpolicy configuration that allows access to the network neighbor table, leading to local information disclosure of network topography with no additional execution privileges and no user interaction required. The incident is described...

CVE-2022-21761

CVE-2022-21761 affects the apusys driver, where an integer overflow can trigger a system crash. This could lead to local denial of service with SYSTEM privileges required and no user interaction. The reported remediation is patch ALPS06479532 (Issue ALPS06479532). The connected sources confirm th...

CVE-2022-21765

CVE-2022-21765 affects the CCCI component. The root cause is a missing bounds check that enables an out-of-bounds write, leading to local escalation of privilege with SYSTEM-level execution rights. Exploitation reportedly does not require user interaction. A patch is referenced (Patch ID: ALPS066...

CVE-2022-21773

CVE-2022-21773 describes a use-after-free in the TEEI driver caused by a race condition, enabling local escalation of privilege to System level without user interaction. Affected component: TEEI driver (details aligned with vendor advisories). The vulnerability could be triggered via a race in th...

CVE-2022-26452

CVE-2022-26452 affects the isp component, describing a use-after-free caused by improper locking. The vulnerability enables local escalation of privilege with System execution privileges required and does not require user interaction. The available connected documents consistently cite a patch id...

CVE-2022-26468

CVE-2022-26468: Out-of-bounds write in the preloader (usb) on MediaTek devices due to a missing bounds check. This can lead to local privilege escalation with physical access and requires user interaction for exploitation. Patch ID ALPS07168125/Issue ALPS07168125 appears in the record; no specifi...

CVE-2022-32612

CVE-2022-32612 concerns a possible memory-use-after-free in the MediaTek/vcu stack caused by a race condition. Reported as enabling local escalation of privilege with System execution privileges required and no user interaction needed. Multiple sources confirm the issue, but public details about ...

CVE-2022-36862

CVE-2022-36862 is a heap-based overflow in HWR::EngineCJK::Impl::Construct() within libSDKRecognitionText.spensdk.samsung.so, affecting Samsung mobile/S pen SDK components prior to the SMR Sep-2022 Release 1. The root cause is a heap overflow that can cause a memory access fault. Public exploitat...