Google Android vulnerabilities

CVE-2022-47367 [MEDIUM] CWE-862 CVE-2022-47367: In bluetooth driver, there is a missing permission check. This could lead to local information discl In bluetooth driver, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.

CVE-2023-21376 [MEDIUM] CWE-269 CVE-2023-21376: In Telephony, there is a possible way to retrieve the ICCID due to a logic error in the code. This c In Telephony, there is a possible way to retrieve the ICCID due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-21271 [MEDIUM] CWE-125 CVE-2023-21271: In parseInputs of ShimPreparedModel.cpp, there is a possible out of bounds read due to improper inpu In parseInputs of ShimPreparedModel.cpp, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-21112 [MEDIUM] CWE-125 CVE-2023-21112: In AnalyzeMfcResp of NxpMfcReader.cc, there is a possible out of bounds read due to a missing bounds In AnalyzeMfcResp of NxpMfcReader.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-252763983

CVE-2023-21080 [MEDIUM] CWE-125 CVE-2023-21080: In register_notification_rsp of btif_rc.cc, there is a possible out of bounds read due to a missing In register_notification_rsp of btif_rc.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-245916076

CVE-2023-21368 [MEDIUM] CWE-125 CVE-2023-21368: In Audio, there is a possible out of bounds read due to missing bounds check. This could lead to loc In Audio, there is a possible out of bounds read due to missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48584 [MEDIUM] CWE-400 CVE-2025-48584: In multiple functions of NotificationManagerService.java, there is a possible way to bypass the per- In multiple functions of NotificationManagerService.java, there is a possible way to bypass the per-package channel limits causing resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2018-9441 [MEDIUM] CWE-125 CVE-2018-9441: In sdp_copy_raw_data of sdp_discovery.cc, there is a possible out of bounds read due to an incorrect In sdp_copy_raw_data of sdp_discovery.cc, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.

CVE-2023-40112 [MEDIUM] CWE-125 CVE-2023-40112: In ippSetValueTag of ipp.c, there is a possible out of bounds read due to a missing bounds check. Th In ippSetValueTag of ipp.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure of past print jobs or other print-related information, with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-21352 [MEDIUM] CWE-125 CVE-2023-21352: In NFA, there is a possible out of bounds read due to a missing bounds check. This could lead to loc In NFA, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-21309 [MEDIUM] CWE-125 CVE-2023-21309: In libcore, there is a possible out of bounds read due to a missing bounds check. This could lead to In libcore, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-42647 [MEDIUM] CVE-2023-42647: In Ifaa service, there is a possible way to write permission usage records of an app due to a missin In Ifaa service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed

CVE-2023-42645 [MEDIUM] CVE-2023-42645: In sim service, there is a possible way to write permission usage records of an app due to a missing In sim service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed

CVE-2023-21311 [MEDIUM] CWE-863 CVE-2023-21311: In Settings, there is a possible way to control private DNS settings from a secondary user due to a In Settings, there is a possible way to control private DNS settings from a secondary user due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-21321 [MEDIUM] CWE-862 CVE-2023-21321: In Package Manager, there is a possible cross-user settings disclosure due to a missing permission c In Package Manager, there is a possible cross-user settings disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-21366 [MEDIUM] CVE-2023-21366: In Scudo, there is a possible way for an attacker to predict heap allocation patterns due to insecur In Scudo, there is a possible way for an attacker to predict heap allocation patterns due to insecure implementation/design. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-21141 [MEDIUM] CWE-862 CVE-2023-21141: In several functions of several files, there is a possible way to access developer mode traces due t In several functions of several files, there is a possible way to access developer mode traces due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A

CVE-2024-29780 [MEDIUM] CWE-908 CVE-2024-29780: In hwbcc_ns_deprivilege of trusty/user/base/lib/hwbcc/client/hwbcc.c, there is a possible uninitiali In hwbcc_ns_deprivilege of trusty/user/base/lib/hwbcc/client/hwbcc.c, there is a possible uninitialized stack data disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-48354 [MEDIUM] CWE-20 CVE-2023-48354: In telephone service, there is a possible improper input validation. This could lead to local inform In telephone service, there is a possible improper input validation. This could lead to local information disclosure with no additional execution privileges needed

CVE-2023-32825 [MEDIUM] CWE-125 CVE-2023-32825: In bluethooth service, there is a possible out of bounds reads due to improper input validation. Thi In bluethooth service, there is a possible out of bounds reads due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07884130; Issue ID: ALPS07884130.