CVE-2017-13162

CVE-2017-13162 is an elevation-of-privilege vulnerability in the Android kernel binder (Binder IPC). The issue is a local exploit affecting the Android kernel components that implement Binder, allowing a non-privileged (local) attacker to escalate privileges with a high impact on confidentiality,...

CVE-2020-0189

In Android 10, the vulnerability CVE-2020-0189 affects the Media Framework (hevc/decoder path) via ihevcd_decode() in ihevcd_decode.c, causing resource exhaustion from an infinite loop. This can lead to remote denial of service without extra execution privileges; exploitation requires user intera...

CVE-2017-0767

CVE-2017-0767 is an Elevation of Privilege vulnerability in Android’s media framework (libeffects) affecting Android versions 4.4.4 through 7.1.2. The issue is described as an EoP in the media stack, enabling a local attacker to execute code with elevated privileges within a privileged process. T...

CVE-2017-0775

CVE-2017-0775 is a DoS in Android’s media framework libstagefright. Affects Android versions 4.4.4–8.0 (including 8.0). The NVD CVSSv3 base score is 5.5 (Medium) with Local attack vector, Low attack complexity, requiring user interaction, and High availability impact. CVSSv2 base score is 7.1 (Hi...

CVE-2017-0797

CVE-2017-0797 is a MediaTek accessory detector driver elevation-of-privilege vulnerability in Android kernels. The issue affects the MediaTek accessory detector driver within the Android kernel, enabling local privilege escalation to a privileged context (high impact per CVSS). The vulnerability ...

CVE-2017-0826

CVE-2017-0826 is an Elevation of Privilege in the HTC bootloader affecting Android kernel on HTC devices. The vulnerability is described as an EoP in the bootloader, enabling privilege escalation within the Android stack. The primary documented impact is local privilege elevation, with CVSS indic...

CVE-2017-0836

CVE-2017-0836 is a remote code execution vulnerability in the Android media framework (libhevc). Affected product: Android. Affected versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. The issue resides in the Media Framework and could allow an attacker to run arbitrary code, typically by...

CVE-2017-0837

CVE-2017-0837 is an elevation of privilege vulnerability in Android’s media framework (libaudiopolicymanager). Affected: Android 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Root cause is an elevation of privilege in the Media framework as noted by the Android Security Bulletin (Media framework sec...

CVE-2017-10709

CVE-2017-10709 affects Elephone P9000 devices running Android 6.0. The lockscreen can be bypassed to defeat the wrong-PIN lockout by pressing backspace after each PIN guess, using physical proximity as the attack vector. Documented impact indicates confidentiality, integrity, and availability may...

CVE-2017-11016

CVE-2017-11016 affects Android on MSM/CAF/Linux kernel variants, specifically when memory allocation fails during create_cal_block in calibration handling, leaving stale pointers. Connected Android bulletin detail positions CVE-2017-11016 under Qualcomm components for Pixel/Nexus devices and clas...

CVE-2017-11022

CVE-2017-11022 affects Android-based MSM platforms (Android for MSM, Firefox OS for MSM, QRD Android) with CAF Linux kernel. The issue is that probe requests from a user’s device may reveal information elements that specify supported Wi‑Fi features, creating a potential privacy exposure if sniffe...

CVE-2017-11028

CVE-2017-11028 affects the Android MSM ISP Camera driver; the vulnerability allows leakage of contents from an arbitrary kernel address to userspace via msm_isp_get_stream_common_data(). Connected sources confirm this is an information-disclosure issue in the Camera subsystem within Android/Linux...

CVE-2017-13152

CVE-2017-13152 is an information disclosure vulnerability in Android’s media framework (libmedia drm) affecting Android 5.1.1 through 8.0.0. The public descriptions identify the affected component and versions, with the Pixel/Nexus security bulletin listing this CVE under the Media framework as a...

CVE-2017-13263

CVE-2017-13263 affects the Android framework (Android 8.0 and 8.1). The incident is classified as an Elevation of Privilege (EoP) in the framework; no specific root-cause technical details are provided in the documents. The accessible sources identify it under the Framework category with a Modera...

CVE-2017-13303

CVE-2017-13303 is a memory information-disclosure vulnerability in the Broadcom bcmdhd driver used by Android kernel. Affected component: Broadcom bcmdhd driver; root cause: information disclosure vulnerability in that driver. Impact per sources: partial confidentiality breach with no integrity/a...

CVE-2017-14917

CVE-2017-14917 affects Android ecosystems (Android for MSM, Firefox OS for MSM, QRD Android) with CAF Linux kernel variants. The issue stems from improper validation of buffer sizes in the message passing interface, enabling potential exploitation via crafted inputs. The CVSS data indicates a cri...

CVE-2017-18644

Samsung CVE-2017-18644 affects mobile devices running L(5.1), M(6.x), and N(7.x). The issue is a heap-based buffer overflow in muic_set_reg_sel when reading MUIC register values (root cause). The Samsung ID is SVE-2017-10011. No fixes or mitigations are detailed in the provided documents; referen...

CVE-2017-18650

The CVE-2017-18650 entry affects Samsung mobile devices running N(7.x) software. The issue is triggered when reading a malformed wpa_supplicant.conf, causing the WifiStateMachine to throw an IllegalArgumentException and the device to reboot. Samsung’s internal tracking references SVE-2017-9828 (O...

CVE-2017-18652

CVE-2017-18652 affects Samsung mobile devices running M(6.0) and N(7.x). The issue is that SVoice can be exploited to execute arbitrary code by manipulating dynamic libraries, enabling code execution with the privileges of the compromised process. The vulnerability is tied to the SVoice component...

CVE-2017-18682

The CVE-2017-18682 entry concerns Samsung mobile devices across KK(4.4), L(5.0/5.1), M(6.0), and N(7.0) where AudioService can crash the system due to incorrect exception handling and an unprotected intent. Affected Samsung identifiers are SVE-2017-8114, SVE-2017-8116, and SVE-2017-8117. Connecte...

CVE-2017-6249

CVE-2017-6249 is an elevation-of-privilege issue affecting NVIDIA’s Tegra kernel audio driver (Audio DSP) on Android. The NVIDIA bulletin specifies that an invalid user parameter may be copied to an output buffer without checking input size, which can allow a local malicious app to execute arbitr...

CVE-2017-7370

CVE-2017-7370 is listed in connected sources as a Qualcomm video driver vulnerability (Video driver) causing an elevation of privilege (EoP) with Moderate severity. The detail consistently attributes the flaw to a race condition in the video driver within Android CAF/Linux kernel deployments. No ...

CVE-2017-8242

CVE-2017-8242 affects Android CAF releases that use the Linux kernel and involve the Secure Execution Environment (QTEE) driver. The issue is a race condition in the QTEE driver that can lead to an arbitrary memory write. The provided connected sources confirm the vulnerability description but do...

CVE-2017-9704

CVE-2017-9704 concerns CAF Android kernels (Android for MSM, Firefox OS for MSM, QRD Android) where there is no synchronization between msm_vb2 buffer operations, enabling a use-after-free condition. Root cause: missing synchronization in buffer handling within the kernel component msm_vb2. Affec...

CVE-2018-11301

CVE-2018-11301 describes an integer overflow caused by a missing buffer-length check while processing debug log events from firmware in Android CAF builds using the Linux kernel, affecting Qualcomm WLAN Host components across Android releases such as Android for MSM, Firefox OS for MSM, and QRD A...

CVE-2018-12010

CVE-2018-12010: Concrete details in connected docs show a stack overflow with memory corruption in the trustzone region affecting Android releases using CAF’s Linux kernel. The root cause is an absence of length sanity checks in the kernel path, leading to potential local impact on trustzone. Rep...

CVE-2018-21082

Affected product: Samsung mobile devices running N(7.x) with Dex Station. Issue: Dex Station enables App Pinning bypass and lock-screen bypass via the To unpin screen lock option. Root cause: bypass of app pinning/lock screen through the “Use screen lock type to unpin” flow. Impact: allows bypass...

CVE-2018-21091

Technical details about CVE-2018-21091 are not publicly available in the provided connected documents. Monitor for updates from vendors and CERT advisories for affected Samsung devices and any published patches or mitigations.

CVE-2018-5842

CVE-2018-5842 describes a WLAN privilege/Arbitrary address write in Qualcomm WLAN on Android devices (CAF Android for MSM, Firefox OS for MSM, QRD Android) due to the WLAN firmware sending incorrect data to the WLAN driver. The root cause is a data handling flaw in the interaction between comprom...

CVE-2018-9412

CVE-2018-9412 concerns a DoS in the Android Media framework due to a resource exhaustion condition in ID3.cpp’s removeUnsynchronization, caused by improper input validation. Exploitation requires user interaction; the vulnerability is local in scope with availability impact high and no confidenti...

CVE-2018-9469

CVE-2018-9469 affects Android frame­work components where ShortcutService.java can create a spoofed shortcut due to a missing permission check. This could enable a local elevation of privilege in a privileged app, with exploitation requiring user interaction. Connected documents confirm the same ...

CVE-2018-9481

CVE-2018-9481 : The vulnerability is in the Bluetooth stack, specifically in the function bta_hd_set_report_act of bta_hd_act.cc. An integer overflow can trigger an out-of-bounds read, enabling remote information disclosure through the Bluetooth service without extra privileges or user interactio...

CVE-2018-9551

CVE-2018-9551 affects Android 9 (Android-9) in the CAacDecoder_Init path of aacdecoder.cpp, where a missing bounds check can cause an out-of-bounds write. This vulnerability could enable remote code execution within the media server with privileges of a privileged process, requiring user interact...

CVE-2018-9555

CVE-2018-9555 applies to Android Bluetooth, where the function l2c_lcc_proc_pdu in l2c_fcr.cc contains a missing bounds check causing an out-of-bounds write. This can enable remote escalation of privilege via Bluetooth with no user interaction, impacting Android 7.0–9 according to the CVE record....

CVE-2018-9589

CVE-2018-9589 affects the Android WiFi stack. In ieee802_11_rx_wnmsleep_req() within wnm_ap.c on Android 7.0–9 (including 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9), there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure in the WiFi driver with ...

CVE-2019-1997

CVE-2019-1997 affects Android’s random.c: In random_get_bytes, an insecure default value degrades randomness, enabling local information disclosure over an insecure wireless connection with no user interaction. Affected Android versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9. Exploitation context: netwo...

CVE-2019-2001

CVE-2019-2001 affects the Android kernel iomem implementation. The issue is that the permissions on /proc/iomem were world-readable, enabling local information disclosure without any execution privileges or user interaction. The vulnerability is a local information disclosure (ID) with impact on ...

CVE-2019-20534

CVE-2019-20534 affects Samsung mobile devices running Android P (9.0). The issue allows an attacker to view the home-screen wallpaper by adjusting the brightness on a locked screen. The description repeatedly mirrors Samsung’s SVE-2019-15540 identifier; Red Hat and CNVD/EUVD/CVE records corrobora...

CVE-2019-20552

CVE-2019-20552 concerns FRP (Factory Reset Protection) bypass on Samsung mobile devices running Android P (9.0) via an RCS call. Connected sources corroborate a FRP bypass vulnerability affecting Samsung devices; one CNVD entry characterizes the underlying issue as an input validation error, whil...

CVE-2019-20575

The CVE-2019-20575 entry concerns Samsung mobile devices running P(9.0). The vulnerability lies in the WPA3 handshake, allowing a downgrade or dictionary attack. Affected component: WPA3 handshake implementation on Samsung devices (SVE-2019-14204 reference). The available connected records corrob...

CVE-2019-20610

The CVE-2019-20610 entry describes a double-fetch vulnerability in Trustlet on Samsung mobile devices running N(7.X) and O(8.X) with Exynos 7570/7870/7880/7885/8890/8895/9810 chipsets, enabling arbitrary TEE code execution. Affected component: Trustlet in the TEE. Root cause: double-fetch window ...

CVE-2019-2084

The CVE-2019-2084 issue affects the libxaac library in Android 10. It is caused by a missing bounds check that allows an out‑of‑bounds write, enabling remote code execution. Exploitation requires user interaction. The vulnerability impacts Android 10 devices with libxaac, and multiple connected s...

CVE-2019-2121

CVE-2019-2121 : A race condition in ActivityManagerService.attachApplication on Android 9 (Pie) can lead to local escalation of privilege without extra privileges; no user interaction required. Affected component is the framework entry point for app attachment. The core issue is a race in attachi...

CVE-2019-2200

CVE-2019-2200 affects Android 10 where updatePermissions in PermissionManagerService.java could allow a malicious app to bypass a custom-permission check, enabling local privilege escalation with full confidentiality/ integrity/ availability impact as described. Root cause: permission bypass with...

CVE-2019-2208

CVE-2019-2208 affects Android components (Android 8.1 and 9) with a flaw in V8 JIT code during PromiseBuiltinsAssembler::NewPromiseCapability, causing an out-of-bounds read. This can lead to remote information disclosure without user interaction or privileges. The connected records confirm the is...

CVE-2020-0015

CVE-2020-0015 affects the Android framework via CertInstaller.java (onCreate), where an attacker could overlay the Certificate Installation dialog to escalate privileges locally without extra execution privileges. Impact is described as local EoP with partial confidentiality/integrity/availabilit...

CVE-2020-0088

CVE-2020-0088 affects Android 10 and is caused by an issue in parseTrackFragmentRun within MPEG4Extractor.cpp that can lead to resource exhaustion and a remote Denial of Service. Exploitation requires user interaction. The description does not specify the exact vulnerable versions beyond Android-...

CVE-2020-0104

CVE-2020-0104 affects Android 9 and 10, due to a logic error in KeyguardStateMonitor.java (onShowingStateChanged) that can disclose keyguard-protected data locally without extra privileges or user interaction. The issue is documented with a local-privilege/exposure impact (CVSS 3.1/5.5; CVSS2 bas...

CVE-2020-0190

CVE-2020-0190 affects Android 10 with a vulnerability in ideint_weave_blk of ideint_utils.c caused by a heap buffer overflow leading to an out-of-bounds write. This could enable remote code execution. Exploitation requires user interaction per the description. The Pixel security bulletin lists CV...

CVE-2020-0296

The CVE-2020-0296 issue affects Android 11’s ADB server and USB server, where an unsafe PendingIntent causes a permission bypass that can lead to local information disclosure. Exploitation is local (no user interaction required per the description) and relies on an attacker with access to the dev...