Google Android vulnerabilities

CVE-2021-25519 [LOW] CWE-200 CVE-2021-25519: An improper access control vulnerability in CPLC prior to SMR Dec-2021 Release 1 allows local attack An improper access control vulnerability in CPLC prior to SMR Dec-2021 Release 1 allows local attackers to access CPLC information without permission.

CVE-2022-20311 [LOW] CWE-862 CVE-2022-20311: In Telecomm, there is a possible disclosure of registered self managed phone accounts due to a missi In Telecomm, there is a possible disclosure of registered self managed phone accounts due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-192663553

CVE-2022-20310 [LOW] CWE-862 CVE-2022-20310: In Telecomm, there is a possible disclosure of registered self managed phone accounts due to a missi In Telecomm, there is a possible disclosure of registered self managed phone accounts due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-192663798

CVE-2022-28794 [LOW] CWE-213 CVE-2022-28794: Sensitive information exposure in low-battery dumpstate log prior to SMR Jun-2022 Release 1 allows l Sensitive information exposure in low-battery dumpstate log prior to SMR Jun-2022 Release 1 allows local attackers to get SIM card information.

CVE-2022-42757 [LOW] CWE-126 CVE-2022-42757: In wlan driver, there is a possible missing bounds check, This could lead to local denial of service In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.

CVE-2022-42758 [LOW] CWE-126 CVE-2022-42758: In wlan driver, there is a possible missing bounds check, This could lead to local denial of service In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.

CVE-2022-42769 [LOW] CWE-125 CVE-2022-42769: In wlan driver, there is a possible missing bounds check, This could lead to local denial of service In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.

CVE-2022-39884 [LOW] CWE-284 CVE-2022-39884: Improper access control vulnerability in IImsService prior to SMR Nov-2022 Release 1 allows local at Improper access control vulnerability in IImsService prior to SMR Nov-2022 Release 1 allows local attacker to access to Call information.

CVE-2022-42767 [LOW] CWE-190 CVE-2022-42767: In wlan driver, there is a possible missing bounds check, This could lead to local denial of service In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.

CVE-2022-33724 [LOW] CWE-200 CVE-2022-33724: Exposure of Sensitive Information in Samsung Dialer application?prior to SMR Aug-2022 Release 1 allo Exposure of Sensitive Information in Samsung Dialer application?prior to SMR Aug-2022 Release 1 allows local attackers to access ICCID via log.

CVE-2015-6627 [LOW] CWE-200 CVE-2015-6627: The Audio component in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows remote attackers The Audio component in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows remote attackers to obtain sensitive information via a crafted audio file, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 24211743.

CVE-2021-25340 [LOW] CWE-284 CVE-2021-25340: Improper access control vulnerability in Samsung keyboard version prior to SMR Feb-2021 Release 1 al Improper access control vulnerability in Samsung keyboard version prior to SMR Feb-2021 Release 1 allows physically proximate attackers to change in arbitrary settings during Initialization State.

CVE-2021-25409 [LOW] CWE-703 CVE-2021-25409: Improper access in Notification setting prior to SMR JUN-2021 Release 1 allows physically proximate Improper access in Notification setting prior to SMR JUN-2021 Release 1 allows physically proximate attackers to set arbitrary notification via physically configuring device.

CVE-2022-20240 [LOW] CWE-862 CVE-2022-20240: In sOpAllowSystemRestrictionBypass of AppOpsManager.java, there is a possible leak of location infor In sOpAllowSystemRestrictionBypass of AppOpsManager.java, there is a possible leak of location information due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12LAndroid ID: A-231496105

CVE-2017-0709 [LOW] CWE-200 CVE-2017-0709: A information disclosure vulnerability in the HTC sensor hub driver. Product: Android. Versions: And A information disclosure vulnerability in the HTC sensor hub driver. Product: Android. Versions: Android kernel. Android ID: A-35468048.

CVE-2019-20623 [LOW] CWE-908 CVE-2019-20623: An issue was discovered on Samsung mobile devices with N(7.1), O(8.x), and P(9.0) software. Gallery An issue was discovered on Samsung mobile devices with N(7.1), O(8.x), and P(9.0) software. Gallery has uninitialized memory disclosure. The Samsung ID is SVE-2018-13060 (February 2019).

CVE-2018-21074 [LOW] CWE-200 CVE-2018-21074: An issue was discovered on Samsung mobile devices with M(6.x) (Exynos or Qualcomm chipsets) software An issue was discovered on Samsung mobile devices with M(6.x) (Exynos or Qualcomm chipsets) software. There is information disclosure from a Trustlet via the debug log. The Samsung ID is SVE-2017-10638 (April 2018).

CVE-2022-20535 [LOW] CWE-203 CVE-2022-20535: In registerLocalOnlyHotspotSoftApCallback of WifiManager.java, there is a possible way to determine In registerLocalOnlyHotspotSoftApCallback of WifiManager.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: An

CVE-2022-20559 [LOW] CWE-203 CVE-2022-20559: In revokeOwnPermissionsOnKill of PermissionManager.java, there is a possible way to determine whethe In revokeOwnPermissionsOnKill of PermissionManager.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: Android

CVE-2021-0995 [LOW] CWE-203 CVE-2021-0995: In registerSuggestionConnectionStatusListener of WifiServiceImpl.java, there is a possible way to de In registerSuggestionConnectionStatusListener of WifiServiceImpl.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Prod