Google Android vulnerabilities

CVE-2022-33721 [MEDIUM] CWE-94 CVE-2022-33721: A vulnerability using PendingIntent in DeX for PC prior to SMR Aug-2022 Release 1 allows attackers t A vulnerability using PendingIntent in DeX for PC prior to SMR Aug-2022 Release 1 allows attackers to access files with system privilege.

CVE-2023-48412 [MEDIUM] CVE-2023-48412: In private_handle_t of mali_gralloc_buffer.h, there is a possible information leak due to a logic e In private_handle_t of mali_gralloc_buffer.h, there is a possible information leak due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-21295 [MEDIUM] CVE-2023-21295: In SliceManagerService, there is a possible way to check if a content provider is installed due to a In SliceManagerService, there is a possible way to check if a content provider is installed due to a missing null check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2021-0643 [MEDIUM] CWE-862 CVE-2021-0643: In getAllSubInfoList of SubscriptionController.java, there is a possible way to retrieve a long term In getAllSubInfoList of SubscriptionController.java, there is a possible way to retrieve a long term identifier without the correct permissions due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 An

CVE-2023-21293 [MEDIUM] CWE-203 CVE-2023-21293: In PackageManagerNative, there is a possible way to determine whether an app is installed, without q In PackageManagerNative, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2022-33715 [MEDIUM] CWE-20 CVE-2022-33715: Improper access control and path traversal vulnerability in LauncherProvider prior to SMR Aug-2022 R Improper access control and path traversal vulnerability in LauncherProvider prior to SMR Aug-2022 Release 1 allow local attacker to access files of One UI.

CVE-2024-43082 [MEDIUM] CWE-125 CVE-2024-43082: In onActivityResult of EditUserPhotoController.java, there is a possible cross-user media read due t In onActivityResult of EditUserPhotoController.java, there is a possible cross-user media read due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-42718 [MEDIUM] CWE-668 CVE-2023-42718: In dialer, there is a possible way to write permission usage records of an app due to a missing perm In dialer, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed

CVE-2023-48401 [MEDIUM] CWE-125 CVE-2023-48401: In GetSizeOfEenlRecords of protocoladapter.cpp, there is a possible out of bounds read due to an inc In GetSizeOfEenlRecords of protocoladapter.cpp, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-21329 [MEDIUM] CWE-862 CVE-2023-21329: In Activity Manager, there is a possible way to determine whether an app is installed due to a missi In Activity Manager, there is a possible way to determine whether an app is installed due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-21340 [MEDIUM] CWE-862 CVE-2023-21340: In Telecomm, there is a possible way to get the call state due to a missing permission check. This c In Telecomm, there is a possible way to get the call state due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-21338 [MEDIUM] CWE-203 CVE-2023-21338: In Input Method, there is a possible way to determine whether an app is installed, without query per In Input Method, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-21394 [MEDIUM] CVE-2023-21394: In registerPhoneAccount of TelecomServiceImpl.java, there is a possible way to reveal images from an In registerPhoneAccount of TelecomServiceImpl.java, there is a possible way to reveal images from another user due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2022-20393 [MEDIUM] CWE-191 CVE-2022-20393: In extract3GPPGlobalDescriptions of TextDescriptions.cpp, there is a possible out of bounds read due In extract3GPPGlobalDescriptions of TextDescriptions.cpp, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure from the media server with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12LA

CVE-2024-43084 [MEDIUM] CWE-1021 CVE-2024-43084: In visitUris of multiple files, there is a possible information disclosure due to a confused deputy. In visitUris of multiple files, there is a possible information disclosure due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-42698 [MEDIUM] CWE-862 CVE-2023-42698: In omacp service, there is a possible way to write permission usage records of an app due to a missi In omacp service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed

CVE-2023-42730 [MEDIUM] CWE-862 CVE-2023-42730: In IMS service, there is a possible way to write permission usage records of an app due to a missing In IMS service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed

CVE-2023-42697 [MEDIUM] CWE-862 CVE-2023-42697: In omacp service, there is a possible way to write permission usage records of an app due to a missi In omacp service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed

CVE-2023-42699 [MEDIUM] CWE-862 CVE-2023-42699: In omacp service, there is a possible way to write permission usage records of an app due to a missi In omacp service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed

CVE-2023-42737 [MEDIUM] CWE-862 CVE-2023-42737: In telecom service, there is a possible way to write permission usage records of an app due to a mis In telecom service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed