CVE-2013-4787

Android 1.6–4.2 (Donut to Jelly Bean) contains a flaw in verifying APK cryptographic signatures: an APK.modified file with duplicate Zip entries may be installed despite one entry being validated, enabling arbitrary code execution via the Master Key vulnerability. The issue arises from inconsiste...

CVE-2013-5933

The CVE-2013-5933 entry describes a stack-based buffer overflow in the sub_E110 function of init on Android 2.3.7 running on the Motorola Defy XT (Republic Wireless configuration). The vulnerability arises when a long string is written to the /dev/socket/init_runit LocalSocket, in a way inconsist...

CVE-2013-4777

Summary of CVE-2013-4777 (Android 2.3.7, Motorola Defy XT, Republic Wireless) The advisory describes an exploit path where the device’s init process creates a /dev/socket/init_runit LocalSocket to accept shell commands. The underlying issue is a stack-based buffer overflow in the sub_E110 functio...

CVE-2011-1350

The CVE-2011-1350 entry describes an information-disclosure vulnerability in the PowerVR SGX driver used by Android prior to 2.3.6. The flaw allows an attacker to leak potentially sensitive data from kernel stack memory via a crafted request to the pvrsrvkm device. Affected component: PowerVR SGX...

CVE-2013-3666

CVE-2013-3666 affects LG’s Hidden Menu component on Android for the LG Optimus G E973. The vulnerability allows physically proximate attackers to execute shell commands by entering USB Debugging mode and using adb to establish a USB connection, dialing 3845#*973#, navigating to WLAN Test > Wi‑...

CVE-2013-6271

CVE-2013-6271 affects Android 4.0–4.3; a vulnerability in com.android.settings.ChooseLockGeneric allows an unprivileged app to bypass restrictions and remove the device lock by invoking updateUnlockMethodAndFinish with PASSWORD_QUALITY_UNSPECIFIED. Exploits/PoC exist (CRT-RemoveLocks; Metasploit ...

CVE-2011-1352

The CVE-2011-1352 issue affects the PowerVR SGX driver used in Android prior to 2.3.6. A local attacker can trigger kernel memory corruption via the pvrsrvkm device by supplying crafted user data, enabling privilege escalation to root. Multiple connected sources (including Levitator exploit code,...