Google Android vulnerabilities

CVE-2023-42741 [MEDIUM] CWE-862 CVE-2023-42741: In telecom service, there is a possible way to write permission usage records of an app due to a mis In telecom service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed

CVE-2023-42749 [MEDIUM] CWE-862 CVE-2023-42749: In enginnermode service, there is a possible way to write permission usage records of an app due to In enginnermode service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed

CVE-2023-21294 [MEDIUM] CWE-862 CVE-2023-21294: In Slice, there is a possible disclosure of installed packages due to a missing permission check. Th In Slice, there is a possible disclosure of installed packages due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-21019 [MEDIUM] CWE-125 CVE-2023-21019: In ih264e_init_proc_ctxt of ih264e_process.c, there is a possible out of bounds read due to a heap b In ih264e_init_proc_ctxt of ih264e_process.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-242379731

CVE-2023-21200 [MEDIUM] CWE-125 CVE-2023-21200: In on_remove_iso_data_path of btm_iso_impl.h, there is a possible out of bounds read due to improper In on_remove_iso_data_path of btm_iso_impl.h, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-236688764

CVE-2023-21198 [MEDIUM] CWE-125 CVE-2023-21198: In remove_sdp_record of btif_sdp_server.cc, there is a possible out of bounds read due to a missing In remove_sdp_record of btif_sdp_server.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-245517503

CVE-2023-21168 [MEDIUM] CWE-125 CVE-2023-21168: In convertCbYCrY of ColorConverter.cpp, there is a possible out of bounds read due to a missing boun In convertCbYCrY of ColorConverter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-253270285

CVE-2023-20980 [MEDIUM] CWE-125 CVE-2023-20980: In btu_ble_ll_conn_param_upd_evt of btu_hcif.cc, there is a possible out of bounds read due to a mis In btu_ble_ll_conn_param_upd_evt of btu_hcif.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure in the Bluetooth server with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-260230274

CVE-2023-20952 [MEDIUM] CWE-787 CVE-2023-20952: In A2DP_BuildCodecHeaderSbc of a2dp_sbc.cc, there is a possible out of bounds write due to a missing In A2DP_BuildCodecHeaderSbc of a2dp_sbc.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-18680351

CVE-2023-21292 [MEDIUM] CVE-2023-21292: In openContentUri of ActivityManagerService.java, there is a possible way for a third party app to o In openContentUri of ActivityManagerService.java, there is a possible way for a third party app to obtain restricted files due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-40124 [MEDIUM] CWE-125 CVE-2023-40124: In multiple locations, there is a possible cross-user read due to a confused deputy. This could lead In multiple locations, there is a possible cross-user read due to a confused deputy. This could lead to local information disclosure of photos or other images with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-21384 [MEDIUM] CVE-2023-21384: In Package Manager, there is a possible possible permissions bypass due to an unsafe PendingIntent. In Package Manager, there is a possible possible permissions bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-40139 [MEDIUM] CWE-610 CVE-2023-40139: In FillUi of FillUi.java, there is a possible way to view another user's images due to a confused de In FillUi of FillUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-21277 [MEDIUM] CVE-2023-21277: In visitUris of RemoteViews.java, there is a possible way to reveal images across users due to a mis In visitUris of RemoteViews.java, there is a possible way to reveal images across users due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-21279 [MEDIUM] CVE-2023-21279: In visitUris of RemoteViews.java, there is a possible cross-user media read due to a confused deputy In visitUris of RemoteViews.java, there is a possible cross-user media read due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2022-48371 [MEDIUM] CWE-862 CVE-2022-48371: In dialer service, there is a possible missing permission check. This could lead to local informatio In dialer service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges.

CVE-2022-48242 [MEDIUM] CWE-862 CVE-2022-48242: In telephony service, there is a possible missing permission check. This could lead to local informa In telephony service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges.

CVE-2022-48370 [MEDIUM] CWE-862 CVE-2022-48370: In dialer service, there is a possible missing permission check. This could lead to local informatio In dialer service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges.

CVE-2023-21312 [MEDIUM] CVE-2023-21312: In IntentResolver, there is a possible cross-user media read due to a confused deputy. This could le In IntentResolver, there is a possible cross-user media read due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-21289 [MEDIUM] CVE-2023-21289: In multiple locations, there is a possible bypass of a multi user security boundary due to a confuse In multiple locations, there is a possible bypass of a multi user security boundary due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.