Google Android vulnerabilities

CVE-2017-13255 [HIGH] CWE-787 CVE-2017-13255: In process_service_attr_req of sdp_server.c, there is an out of bounds write due to a missing bounds In process_service_attr_req of sdp_server.c, there is an out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-68776054.

CVE-2019-2009 [HIGH] CWE-787 CVE-2019-2009: In l2c_lcc_proc_pdu of l2c_fcr.cc, there is a possible out of bounds write due to a missing bounds c In l2c_lcc_proc_pdu of l2c_fcr.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android

CVE-2011-1352 [MEDIUM] CWE-119 CVE-2011-1352: The PowerVR SGX driver in Android before 2.3.6 allows attackers to gain root privileges via an appli The PowerVR SGX driver in Android before 2.3.6 allows attackers to gain root privileges via an application that triggers kernel memory corruption using crafted user data to the pvrsrvkm device.

CVE-2022-20362 [HIGH] CWE-190 CVE-2022-20362: In Bluetooth, there is a possible out of bounds write due to an integer overflow. This could lead to In Bluetooth, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-230756082

CVE-2022-20283 [HIGH] CWE-190 CVE-2022-20283: In Bluetooth, there is a possible out of bounds write due to an integer overflow. This could lead to In Bluetooth, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-233069336

CVE-2023-21108 [HIGH] CWE-416 CVE-2023-21108: In sdpu_build_uuid_seq of sdp_discovery.cc, there is a possible out of bounds write due to a use aft In sdpu_build_uuid_seq of sdp_discovery.cc, there is a possible out of bounds write due to a use after free. This could lead to remote code execution over Bluetooth, if HFP support is enabled, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Andr

CVE-2024-47014 [HIGH] CWE-276 CVE-2024-47014: Android before 2024-10-05 on Google Pixel devices allows privilege escalation in the ABL component, Android before 2024-10-05 on Google Pixel devices allows privilege escalation in the ABL component, A-330537292.

CVE-2023-35673 [HIGH] CWE-190 CVE-2023-35673: In build_read_multi_rsp of gatt_sr.cc, there is a possible out of bounds write due to an integer ove In build_read_multi_rsp of gatt_sr.cc, there is a possible out of bounds write due to an integer overflow. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2024-20040 [HIGH] CWE-787 CVE-2024-20040: In wlan firmware, there is a possible out of bounds write due to improper input validation. This cou In wlan firmware, there is a possible out of bounds write due to improper input validation. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08360153 (for MT6XXX chipsets) / WCNCR00363530 (for MT79XX chipsets); Issue ID: MSV-979.

CVE-2023-21273 [HIGH] CWE-787 CVE-2023-21273: In SDP_AddAttribute of sdp_db.cc, there is a possible out of bounds write due to an incorrect bounds In SDP_AddAttribute of sdp_db.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-35684 [HIGH] CWE-787 CVE-2023-35684: In avdt_msg_asmbl of avdt_msg.cc, there is a possible out of bounds write due to an integer overflow In avdt_msg_asmbl of avdt_msg.cc, there is a possible out of bounds write due to an integer overflow. This could lead to paired device escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2016-0835 [CRITICAL] CWE-119 CVE-2016-0835: decoder/impeg2d_dec_hdr.c in mediaserver in Android 6.x before 2016-04-01 allows remote attackers to decoder/impeg2d_dec_hdr.c in mediaserver in Android 6.x before 2016-04-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file that triggers a certain negative value, aka internal bug 26070014.

CVE-2015-3873 [CRITICAL] CWE-119 CVE-2015-3873: libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or c libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bugs 23016072, 23248776, 23247055, 22845824, 22008959, 21814993, 21048776, 20718524, 20674674, 22388975, 20674086, 21443020, and 22077698, a different vulnerability th

CVE-2016-6689 [MEDIUM] CWE-200 CVE-2016-6689: Binder in the kernel in Android before 2016-10-05 on Nexus devices allows attackers to obtain sensit Binder in the kernel in Android before 2016-10-05 on Nexus devices allows attackers to obtain sensitive information via a crafted application, aka internal bug 30768347.

CVE-2016-0839 [CRITICAL] CWE-119 CVE-2016-0839: post_proc/volume_listener.c in mediaserver in Android 6.x before 2016-04-01 mishandles deleted effec post_proc/volume_listener.c in mediaserver in Android 6.x before 2016-04-01 mishandles deleted effect context, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 25753245.

CVE-2016-0841 [CRITICAL] CWE-119 CVE-2016-0841: media/libmedia/mediametadataretriever.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5 media/libmedia/mediametadataretriever.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 mishandles cleared service binders, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 26040840.

CVE-2011-2357 [MEDIUM] CWE-20 CVE-2011-2357: Cross-application scripting vulnerability in the Browser URL loading functionality in Android 2.3.4 Cross-application scripting vulnerability in the Browser URL loading functionality in Android 2.3.4 and 3.1 allows local applications to bypass the sandbox and execute arbitrary Javascript in arbitrary domains by (1) causing the MAX_TAB number of tabs to be opened, then loading a URI to the targeted domain into the current tab, or (2) making two startAc

CVE-2023-35647 [CRITICAL] CWE-125 CVE-2023-35647: In ProtocolEmbmsGlobalCellIdAdapter::Init() of protocolembmsadapter.cpp, there is a possible out of In ProtocolEmbmsGlobalCellIdAdapter::Init() of protocolembmsadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with baseband firmware compromise required. User interaction is not needed for exploitation.

CVE-2023-35648 [CRITICAL] CWE-125 CVE-2023-35648: In ProtocolMiscLceIndAdapter::GetConfLevel() of protocolmiscadapter.cpp, there is a possible out of In ProtocolMiscLceIndAdapter::GetConfLevel() of protocolmiscadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with baseband firmware compromise required. User interaction is not needed for exploitation.

CVE-2021-25449 [CRITICAL] CWE-122 CVE-2021-25449: An improper input validation vulnerability in libsapeextractor library prior to SMR Sep-2021 Release An improper input validation vulnerability in libsapeextractor library prior to SMR Sep-2021 Release 1 allows attackers to execute arbitrary code in mediaextractor process.