Google Android vulnerabilities

CVE-2018-21080 [MEDIUM] CWE-326 CVE-2018-21080: An issue was discovered on Samsung mobile devices with N(7.x) software. A physically proximate attac An issue was discovered on Samsung mobile devices with N(7.x) software. A physically proximate attacker wielding a magnet can activate NFC to bypass the lockscreen. The Samsung ID is SVE-2017-10897 (March 2018).

CVE-2010-4832 [MEDIUM] CWE-310 CVE-2010-4832: Android OS before 2.2 does not display the correct SSL certificate in certain cases, which might all Android OS before 2.2 does not display the correct SSL certificate in certain cases, which might allow remote attackers to spoof trusted web sites via a web page containing references to external sources in which (1) the certificate of the last loaded resource is checked, instead of for the main page, or (2) later certificates are not checked when the

CVE-2020-0017 [MEDIUM] CVE-2020-0017: In multiple places, it was possible for the primary user’s dictionary to be visible to and modifiabl In multiple places, it was possible for the primary user’s dictionary to be visible to and modifiable by secondary users. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-123232892

CVE-2020-0291 [MEDIUM] CWE-125 CVE-2020-0291: In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges and a compromised Firmware needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-146032016

CVE-2020-0018 [MEDIUM] CWE-532 CVE-2020-0018: In MotionEntry::appendDescription of InputDispatcher.cpp, there is a possible log information disclo In MotionEntry::appendDescription of InputDispatcher.cpp, there is a possible log information disclosure. This could lead to local disclosure of user input with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-139945049

CVE-2020-0292 [MEDIUM] CWE-125 CVE-2020-0292: In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges and a compromised Firmware needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-110107252

CVE-2019-9253 [MEDIUM] CWE-922 CVE-2019-9253: In KeyStore, there is a possible storage of symmetric keys in the TEE instead of the strongbox due t In KeyStore, there is a possible storage of symmetric keys in the TEE instead of the strongbox due to a missing strongbox flag. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-109769728

CVE-2019-9360 [MEDIUM] CWE-125 CVE-2019-9360: In the TEE, there's a possible out of bounds read due to a missing bounds check. This could lead to In the TEE, there's a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-120610663

CVE-2022-20449 [MEDIUM] CWE-22 CVE-2022-20449: In writeApplicationRestrictionsLAr of UserManagerService.java, there is a possible overwrite of syst In writeApplicationRestrictionsLAr of UserManagerService.java, there is a possible overwrite of system files due to a path traversal error. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-1

CVE-2020-0135 [MEDIUM] CWE-862 CVE-2020-0135: In dump of RollbackManagerServiceImpl.java, there is a possible backup metadata exposure due to a mi In dump of RollbackManagerServiceImpl.java, there is a possible backup metadata exposure due to a missing permission check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-150949837

CVE-2022-32595 [MEDIUM] CWE-125 CVE-2022-32595: In widevine, there is a possible out of bounds read due to an incorrect bounds check. This could lea In widevine, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07446236; Issue ID: ALPS07446236.

CVE-2020-27043 [MEDIUM] CWE-125 CVE-2020-27043: In nfc_enabled of nfc_main.cc, there is a possible out of bounds read due to an incorrect increment. In nfc_enabled of nfc_main.cc, there is a possible out of bounds read due to an incorrect increment. This could lead to local information disclosure via firmware with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-155234594

CVE-2023-42724 [MEDIUM] CWE-125 CVE-2023-42724: In gpu driver, there is a possible out of bounds read due to a missing bounds check. This could lead In gpu driver, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges needed

CVE-2022-20103 [MEDIUM] CWE-59 CVE-2022-20103: In aee daemon, there is a possible information disclosure due to symbolic link following. This could In aee daemon, there is a possible information disclosure due to symbolic link following. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06383944; Issue ID: ALPS06282684.

CVE-2021-0403 [MEDIUM] CWE-862 CVE-2021-0403: In netdiag, there is a possible information disclosure due to a missing permission check. This could In netdiag, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-11; Patch ID: ALPS05475124.

CVE-2022-26456 [MEDIUM] CWE-59 CVE-2022-26456: In vow, there is a possible information disclosure due to a symbolic link following. This could lead In vow, there is a possible information disclosure due to a symbolic link following. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06545473; Issue ID: ALPS06545473.

CVE-2022-20066 [MEDIUM] CWE-755 CVE-2022-20066: In atf (hwfde), there is a possible leak of sensitive information due to incorrect error handling. T In atf (hwfde), there is a possible leak of sensitive information due to incorrect error handling. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06171729; Issue ID: ALPS06171729.

CVE-2022-20015 [MEDIUM] CWE-908 CVE-2022-20015: In kd_camera_hw driver, there is a possible information disclosure due to uninitialized data. This c In kd_camera_hw driver, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05862966; Issue ID: ALPS05862966.

CVE-2022-20018 [MEDIUM] CWE-908 CVE-2022-20018: In seninf driver, there is a possible information disclosure due to uninitialized data. This could l In seninf driver, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05863018; Issue ID: ALPS05863018.

CVE-2021-0900 [MEDIUM] CWE-125 CVE-2021-0900: In apusys, there is a possible out of bounds read due to an incorrect bounds check. This could lead In apusys, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05672107; Issue ID: ALPS05672055.