Google Android vulnerabilities

CVE-2020-0448 [MEDIUM] CWE-862 CVE-2020-0448: In getPhoneAccountsForPackage of TelecomServiceImpl.java, there is a possible way to access a tracki In getPhoneAccountsForPackage of TelecomServiceImpl.java, there is a possible way to access a tracking identifier due to a missing permission check. This could lead to local information disclosure of the identifier, which could be used to track an account across devices, with no additional execution privileges needed. User interaction is not needed fo

CVE-2023-40083 [MEDIUM] CWE-125 CVE-2023-40083: In parse_gap_data of utils.cc, there is a possible out of bounds read due to a missing bounds check. In parse_gap_data of utils.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-40073 [MEDIUM] CVE-2023-40073: In visitUris of Notification.java, there is a possible cross-user media read due to Confused Deputy. In visitUris of Notification.java, there is a possible cross-user media read due to Confused Deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2020-0495 [MEDIUM] CWE-190 CVE-2020-0495: In decode_Huffman of JBig2_SddProc.cpp, there is a possible out of bounds write due to an integer ov In decode_Huffman of JBig2_SddProc.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-155473137

CVE-2021-0484 [MEDIUM] CWE-909 CVE-2021-0484: In readVector of IMediaPlayer.cpp, there is a possible read of uninitialized heap data due to a miss In readVector of IMediaPlayer.cpp, there is a possible read of uninitialized heap data due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11 Android-8.1Android ID: A-17372076

CVE-2023-40093 [MEDIUM] CWE-922 CVE-2023-40093: In multiple files, there is a possible way that trimmed content could be included in PDF output due In multiple files, there is a possible way that trimmed content could be included in PDF output due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-45781 [MEDIUM] CWE-125 CVE-2023-45781: In parse_gap_data of utils.cc, there is a possible out of bounds read due to a missing bounds check. In parse_gap_data of utils.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.

CVE-2022-20471 [MEDIUM] CWE-125 CVE-2022-20471: In SendIncDecRestoreCmdPart2 of NxpMfcReader.cc, there is a possible out of bounds read due to a mis In SendIncDecRestoreCmdPart2 of NxpMfcReader.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-2381

CVE-2022-32602 [MEDIUM] CWE-125 CVE-2022-32602: In keyinstall, there is a possible out of bounds read due to a missing bounds check. This could lead In keyinstall, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07388790; Issue ID: ALPS07388790.

CVE-2021-0400 [MEDIUM] CWE-20 CVE-2021-0400: In injectBestLocation and handleUpdateLocation of GnssLocationProvider.java, there is a possible inc In injectBestLocation and handleUpdateLocation of GnssLocationProvider.java, there is a possible incorrect reporting of location data to emergency services due to improper input validation. This could lead to incorrect reporting of location data to emergency services with User execution privileges needed. User interaction is not needed for exploitation

CVE-2021-0597 [MEDIUM] CWE-862 CVE-2021-0597: In notifyProfileAdded and notifyProfileRemoved of SipService.java, there is a possible way to retrie In notifyProfileAdded and notifyProfileRemoved of SipService.java, there is a possible way to retrieve SIP account names due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Andro

CVE-2021-0436 [MEDIUM] CWE-190 CVE-2021-0436: In CryptoPlugin::decrypt of CryptoPlugin.cpp, there is a possible out of bounds read due to integer In CryptoPlugin::decrypt of CryptoPlugin.cpp, there is a possible out of bounds read due to integer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-176496160

CVE-2021-0620 [MEDIUM] CWE-125 CVE-2021-0620: In asf extractor, there is a possible out of bounds read due to a heap buffer overflow. This could l In asf extractor, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05489178; Issue ID: ALPS05561381.

CVE-2021-0624 [MEDIUM] CWE-125 CVE-2021-0624: In flv extractor, there is a possible out of bounds read due to a heap buffer overflow. This could l In flv extractor, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05594988; Issue ID: ALPS05594988.

CVE-2021-0622 [MEDIUM] CWE-125 CVE-2021-0622: In asf extractor, there is a possible out of bounds read due to a heap buffer overflow. This could l In asf extractor, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05489178; Issue ID: ALPS05561388.

CVE-2021-0414 [MEDIUM] CWE-125 CVE-2021-0414: In flv extractor, there is a possible out of bounds read due to a heap buffer overflow. This could l In flv extractor, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05561384; Issue ID: ALPS05561384.

CVE-2021-0616 [MEDIUM] CWE-125 CVE-2021-0616: In ape extractor, there is a possible out of bounds read due to a heap buffer overflow. This could l In ape extractor, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05561389; Issue ID: ALPS05561389.

CVE-2021-0617 [MEDIUM] CWE-125 CVE-2021-0617: In ape extractor, there is a possible out of bounds read due to a heap buffer overflow. This could l In ape extractor, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05561391; Issue ID: ALPS05561391.

CVE-2021-0618 [MEDIUM] CWE-125 CVE-2021-0618: In ape extractor, there is a possible out of bounds read due to a heap buffer overflow. This could l In ape extractor, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05561394; Issue ID: ALPS05561394.

CVE-2023-40098 [MEDIUM] CVE-2023-40098: In mOnDone of NotificationConversationInfo.java, there is a possible way to access app notification In mOnDone of NotificationConversationInfo.java, there is a possible way to access app notification data of another user due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.