Google Android vulnerabilities

CVE-2018-9581 [LOW] CWE-200 CVE-2018-9581: In WiFi, the RSSI value and SSID information is broadcast as part of android.net.wifi.RSSI_CHANGE an In WiFi, the RSSI value and SSID information is broadcast as part of android.net.wifi.RSSI_CHANGE and android.net.wifi.STATE_CHANGE intents. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-111698366

CVE-2019-9440 [LOW] CVE-2019-9440: In AOSP Email, there is a possible information disclosure due to a confused deputy. This could lead In AOSP Email, there is a possible information disclosure due to a confused deputy. This could lead to local disclosure of the Email app's protected files with User execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-37637796

CVE-2019-9438 [LOW] CVE-2019-9438: In the Package Manager service, there is a possible information disclosure due to a confused deputy. In the Package Manager service, there is a possible information disclosure due to a confused deputy. This could lead to local disclosure of information about installed packages for other users with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-77821568

CVE-2018-21043 [LOW] CWE-200 CVE-2018-21043: An issue was discovered on Samsung mobile devices with O(8.x) and P(9.0) (Exynos 9810 chipsets) soft An issue was discovered on Samsung mobile devices with O(8.x) and P(9.0) (Exynos 9810 chipsets) software. There is information disclosure about a kernel pointer in the g2d_drv driver because of logging. The Samsung ID is SVE-2018-13035 (December 2018).

CVE-2019-20625 [LOW] CWE-532 CVE-2019-20625: An issue was discovered on Samsung mobile devices with N(7.1) and O(8.x) (Exynos chipsets) software. An issue was discovered on Samsung mobile devices with N(7.1) and O(8.x) (Exynos chipsets) software. The ion debugfs driver allows information disclosure. The Samsung ID is SVE-2018-13427 (February 2019).

CVE-2019-20533 [LOW] CWE-287 CVE-2019-20533: An issue was discovered on Samsung mobile devices with N(7.x), O(8.x), and P(9.0) (released in China An issue was discovered on Samsung mobile devices with N(7.x), O(8.x), and P(9.0) (released in China or India) software. The S Secure app can launch masked apps without a password. The Samsung ID is SVE-2019-13996 (December 2019).

CVE-2022-39856 [LOW] CWE-200 CVE-2022-39856: Improper access control vulnerability in imsservice application prior to SMR Oct-2022 Release 1 allo Improper access control vulnerability in imsservice application prior to SMR Oct-2022 Release 1 allows local attackers to access call information.

CVE-2022-39851 [LOW] CWE-284 CVE-2022-39851: Improper access control vulnerability in CocktailBarService prior to SMR Oct-2022 Release 1 allows l Improper access control vulnerability in CocktailBarService prior to SMR Oct-2022 Release 1 allows local attacker to bind service that require BIND_REMOTEVIEWS permission.

CVE-2021-39739 [LOW] CWE-532 CVE-2021-39739: In ArrayMap, there is a possible leak of the content of SMS messages due to log information disclosu In ArrayMap, there is a possible leak of the content of SMS messages due to log information disclosure. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-184525194

CVE-2021-25359 [LOW] CWE-284 CVE-2021-25359: An improper SELinux policy prior to SMR APR-2021 Release 1 allows local attackers to access AP infor An improper SELinux policy prior to SMR APR-2021 Release 1 allows local attackers to access AP information without proper permissions via untrusted applications.

CVE-2021-25358 [LOW] CWE-256 CVE-2021-25358: A vulnerability that stores IMSI values in an improper path prior to SMR APR-2021 Release 1 allows l A vulnerability that stores IMSI values in an improper path prior to SMR APR-2021 Release 1 allows local attackers to access IMSI values without any permission via untrusted applications.

CVE-2022-20321 [LOW] CWE-862 CVE-2022-20321: In Settings, there is a possible way for an application without permissions to read content of WiFi In Settings, there is a possible way for an application without permissions to read content of WiFi QR codes due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-187176859

CVE-2022-30728 [LOW] CWE-213 CVE-2022-30728: Information exposure vulnerability in ScanPool prior to SMR Jun-2022 Release 1 allows local attacker Information exposure vulnerability in ScanPool prior to SMR Jun-2022 Release 1 allows local attackers to get MAC address information.

CVE-2022-30714 [LOW] CWE-213 CVE-2022-30714: Information exposure vulnerability in SemIWCMonitor prior to SMR Jun-2022 Release 1 allows local att Information exposure vulnerability in SemIWCMonitor prior to SMR Jun-2022 Release 1 allows local attackers to get MAC address information.

CVE-2022-33688 [LOW] CWE-532 CVE-2022-33688: Sensitive information exposure vulnerability in EventType in SecTelephonyProvider prior to SMR Jul-2 Sensitive information exposure vulnerability in EventType in SecTelephonyProvider prior to SMR Jul-2022 Release 1 allows local attackers with log access permission to get IMSI through device log.

CVE-2022-33698 [LOW] CWE-200 CVE-2022-33698: Exposure of Sensitive Information in Telecom application prior to SMR Jul-2022 Release 1 allows loca Exposure of Sensitive Information in Telecom application prior to SMR Jul-2022 Release 1 allows local attackers to access ICCID via log.

CVE-2022-33694 [LOW] CWE-213 CVE-2022-33694: Exposure of Sensitive Information in CSC application prior to SMR Jul-2022 Release 1 allows local at Exposure of Sensitive Information in CSC application prior to SMR Jul-2022 Release 1 allows local attacker to access wifi information via unprotected intent broadcasting.

CVE-2022-33697 [LOW] CWE-532 CVE-2022-33697: Sensitive information exposure vulnerability in ImsServiceSwitchBase in ImsCore prior to SMR Jul-202 Sensitive information exposure vulnerability in ImsServiceSwitchBase in ImsCore prior to SMR Jul-2022 Release 1 allows local attackers with log access permission to get IMSI through device log.

CVE-2022-27832 [LOW] CWE-125 CVE-2022-27832: Improper boundary check in media.extractor library prior to SMR Apr-2022 Release 1 allows attackers Improper boundary check in media.extractor library prior to SMR Apr-2022 Release 1 allows attackers to cause denial of service via a crafted media file.

CVE-2022-30753 [LOW] CWE-200 CVE-2022-30753: Improper use of a unique device ID in unprotected SecSoterService prior to SMR Jul-2022 Release 1 al Improper use of a unique device ID in unprotected SecSoterService prior to SMR Jul-2022 Release 1 allows local attackers to get the device ID without permission.