Google Android vulnerabilities

CVE-2023-20958 [HIGH] CWE-125 CVE-2023-20958: In read_paint of ttcolr.c, there is a possible out of bounds read due to a heap buffer overflow. Thi In read_paint of ttcolr.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-254803162

CVE-2021-25388 [HIGH] CWE-926 CVE-2021-25388: Improper caller check vulnerability in Knox Core prior to SMR MAY-2021 Release 1 allows attackers to Improper caller check vulnerability in Knox Core prior to SMR MAY-2021 Release 1 allows attackers to install arbitrary app.

CVE-2016-2059 [HIGH] CWE-269 CVE-2016-2059: The msm_ipc_router_bind_control_port function in net/ipc_router/ipc_router_core.c in the IPC router The msm_ipc_router_bind_control_port function in net/ipc_router/ipc_router_core.c in the IPC router kernel module for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not verify that a port is a client port, which allows attackers to gain privileges or cause a denial of serv

CVE-2018-9586 [HIGH] CWE-362 CVE-2018-9586: In run of InstallPackageTask.java in Android-7.0, Android-7.1.1, Android-7.1.2, Android-8.0, Android In run of InstallPackageTask.java in Android-7.0, Android-7.1.1, Android-7.1.2, Android-8.0, Android-8.1 and Android-9, it is possible that package verification is turned off and remains off due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploit

CVE-2022-20082 [HIGH] CWE-362 CVE-2022-20082: In GPU, there is a possible use after free due to a race condition. This could lead to local escalat In GPU, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07044730; Issue ID: ALPS07044730.

CVE-2022-20110 [HIGH] CWE-367 CVE-2022-20110: In ion, there is a possible use after free due to a race condition. This could lead to local escalat In ion, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06399915; Issue ID: ALPS06399901.

CVE-2019-2019 [MEDIUM] CWE-125 CVE-2019-2019: In ce_t4t_data_cback of ce_t4t.cc, there is a possible out-of-bound read due to a missing bounds che In ce_t4t_data_cback of ce_t4t.cc, there is a possible out-of-bound read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9Android ID

CVE-2019-9283 [MEDIUM] CWE-20 CVE-2019-9283: In AAC Codec, there is a possible resource exhaustion due to improper input validation. This could l In AAC Codec, there is a possible resource exhaustion due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-112663564

CVE-2025-48618 [MEDIUM] CWE-667 CVE-2025-48618: In processLaunchBrowser of CommandParamsFactory.java, there is a possible browser interaction from t In processLaunchBrowser of CommandParamsFactory.java, there is a possible browser interaction from the lockscreen due to improper locking. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2021-0356 [MEDIUM] CWE-77 CVE-2021-0356: In netdiag, there is a possible command injection due to improper input validation. This could lead In netdiag, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-10, Android-11; Patch ID: ALPS05442014.

CVE-2021-0358 [MEDIUM] CWE-77 CVE-2021-0358: In netdiag, there is a possible command injection due to improper input validation. This could lead In netdiag, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-10, Android-11; Patch ID: ALPS05442022.

CVE-2020-0351 [MEDIUM] CWE-20 CVE-2020-0351: In libstagefright, there is possible CPU exhaustion due to improper input validation. This could lea In libstagefright, there is possible CPU exhaustion due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-124777537

CVE-2019-2022 [MEDIUM] CWE-125 CVE-2019-2022: In rw_t3t_act_handle_fmt_rsp and rw_t3t_act_handle_sro_rsp of rw_t3t.cc, there is a possible out-of- In rw_t3t_act_handle_fmt_rsp and rw_t3t_act_handle_sro_rsp of rw_t3t.cc, there is a possible out-of-bound read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-7.0 Android-7.1.1 Android-7.1.2 Andro

CVE-2019-2020 [MEDIUM] CWE-125 CVE-2019-2020: In llcp_dlc_proc_rr_rnr_pdu of llcp_dlc.cc, there is a possible out-of-bound read due to a missing b In llcp_dlc_proc_rr_rnr_pdu of llcp_dlc.cc, there is a possible out-of-bound read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction needed for exploitation.Product: AndroidVersions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9Andr

CVE-2020-0172 [MEDIUM] CWE-20 CVE-2020-0172: In Parse_art of eas_mdls.c, there is possible resource exhaustion due to a missing bounds check. Thi In Parse_art of eas_mdls.c, there is possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-127312550

CVE-2020-0171 [MEDIUM] CWE-20 CVE-2020-0171: In Parse_lart of eas_mdls.c, there is possible resource exhaustion due to a missing bounds check. Th In Parse_lart of eas_mdls.c, there is possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-127313223

CVE-2020-0174 [MEDIUM] CWE-20 CVE-2020-0174: In Parse_ptbl of eas_mdls.c, there is possible resource exhaustion due to a missing bounds check. Th In Parse_ptbl of eas_mdls.c, there is possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-127313537

CVE-2017-13257 [MEDIUM] CWE-416 CVE-2017-13257: In bta_pan_data_buf_ind_cback of bta_pan_act.cc there is a use after free that can result in an out In bta_pan_data_buf_ind_cback of bta_pan_act.cc there is a use after free that can result in an out of bounds read of memory allocated via malloc. This could lead to information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0,

CVE-2018-9563 [MEDIUM] CWE-125 CVE-2018-9563: In llcp_util_parse_cc of llcp_util.cc, there is a possible out-of-bound read due to a missing bounds In llcp_util_parse_cc of llcp_util.cc, there is a possible out-of-bound read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9Androi

CVE-2019-2021 [MEDIUM] CWE-125 CVE-2019-2021: In rw_t3t_act_handle_ndef_detect_rsp of rw_t3t.cc, there is a possible out-of-bound read due to a mi In rw_t3t_act_handle_ndef_detect_rsp of rw_t3t.cc, there is a possible out-of-bound read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 And