Google Android vulnerabilities

CVE-2021-25478 [HIGH] CWE-121 CVE-2021-25478: A possible stack-based buffer overflow vulnerability in Exynos CP Chipset prior to SMR Oct-2021 Rele A possible stack-based buffer overflow vulnerability in Exynos CP Chipset prior to SMR Oct-2021 Release 1 allows arbitrary memory write and code execution.

CVE-2023-33913 [HIGH] CWE-787 CVE-2023-33913: In DRM/oemcrypto, there is a possible out of bounds write due to an incorrect calculation of buffer In DRM/oemcrypto, there is a possible out of bounds write due to an incorrect calculation of buffer size.This could lead to remote escalation of privilege with System execution privileges needed

CVE-2026-28613 [HIGH] CWE-20 CVE-2026-28613: In initAppLinkTypeAndIntent of ChannelImpl.java, there is a possible launch an arbitrary intent due In initAppLinkTypeAndIntent of ChannelImpl.java, there is a possible launch an arbitrary intent due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

CVE-2024-20034 [HIGH] CWE-20 CVE-2024-20034: In battery, there is a possible escalation of privilege due to a missing bounds check. This could le In battery, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08488849; Issue ID: ALPS08488849.

CVE-2017-18648 [CRITICAL] CWE-20 CVE-2017-18648: An issue was discovered on Samsung mobile devices with KK(4.4.x), L(5.x), M(6.x), and N(7.x) softwar An issue was discovered on Samsung mobile devices with KK(4.4.x), L(5.x), M(6.x), and N(7.x) software. Arbitrary file read/write operations can occur in the locked state via a crafted MTP command. The Samsung ID is SVE-2017-10086 (November 2017).

CVE-2019-2016 [HIGH] CWE-20 CVE-2019-2016: In NFA_SendRawFrame of nfa_dm_api.cc, there is a possible out-of-bound write due to improper input v In NFA_SendRawFrame of nfa_dm_api.cc, there is a possible out-of-bound write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9Andro

CVE-2015-1474 [CRITICAL] CWE-189 CVE-2015-1474: Multiple integer overflows in the GraphicBuffer::unflatten function in platform/frameworks/native/li Multiple integer overflows in the GraphicBuffer::unflatten function in platform/frameworks/native/libs/ui/GraphicBuffer.cpp in Android through 5.0 allow attackers to gain privileges or cause a denial of service (memory corruption) via vectors that trigger a large number of (1) file descriptors or (2) integer values.

CVE-2019-2029 [HIGH] CWE-416 CVE-2019-2029: In btm_proc_smp_cback of tm_ble.cc, there is a possible memory corruption due to a use after free. T In btm_proc_smp_cback of tm_ble.cc, there is a possible memory corruption due to a use after free. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-12061

CVE-2016-0809 [HIGH] CWE-264 CVE-2016-0809: Use-after-free vulnerability in the wifi_cleanup function in bcmdhd/wifi_hal/wifi_hal.cpp in Wi-Fi i Use-after-free vulnerability in the wifi_cleanup function in bcmdhd/wifi_hal/wifi_hal.cpp in Wi-Fi in Android 6.x before 2016-02-01 allows attackers to gain privileges by leveraging access to the local physical environment during execution of a crafted application, aka internal bug 25753768.

CVE-2017-0786 [HIGH] CVE-2017-0786: A elevation of privilege vulnerability in the Broadcom wi-fi driver. Product: Android. Versions: And A elevation of privilege vulnerability in the Broadcom wi-fi driver. Product: Android. Versions: Android kernel. Android ID: A-37351060. References: B-V2017060101.

CVE-2017-0787 [HIGH] CVE-2017-0787: A elevation of privilege vulnerability in the Broadcom wi-fi driver. Product: Android. Versions: And A elevation of privilege vulnerability in the Broadcom wi-fi driver. Product: Android. Versions: Android kernel. Android ID: A-37722970. References: B-V2017053104.

CVE-2017-0789 [HIGH] CVE-2017-0789: A elevation of privilege vulnerability in the Broadcom wi-fi driver. Product: Android. Versions: And A elevation of privilege vulnerability in the Broadcom wi-fi driver. Product: Android. Versions: Android kernel. Android ID: A-37685267. References: B-V2017053102.

CVE-2017-0790 [HIGH] CVE-2017-0790: A elevation of privilege vulnerability in the Broadcom wi-fi driver. Product: Android. Versions: And A elevation of privilege vulnerability in the Broadcom wi-fi driver. Product: Android. Versions: Android kernel. Android ID: A-37357704. References: B-V2017053101.

CVE-2017-0791 [HIGH] CVE-2017-0791: A elevation of privilege vulnerability in the Broadcom wi-fi driver. Product: Android. Versions: And A elevation of privilege vulnerability in the Broadcom wi-fi driver. Product: Android. Versions: Android kernel. Android ID: A-37306719. References: B-V2017052302.

CVE-2017-0788 [HIGH] CVE-2017-0788: A elevation of privilege vulnerability in the Broadcom wi-fi driver. Product: Android. Versions: And A elevation of privilege vulnerability in the Broadcom wi-fi driver. Product: Android. Versions: Android kernel. Android ID: A-37722328. References: B-V2017053103.

CVE-2021-25361 [HIGH] CWE-22 CVE-2021-25361: An improper access control vulnerability in stickerCenter prior to SMR APR-2021 Release 1 allows loc An improper access control vulnerability in stickerCenter prior to SMR APR-2021 Release 1 allows local attackers to read or write arbitrary files of system process via untrusted applications.

CVE-2017-0663 [HIGH] CWE-787 CVE-2017-0663: A remote code execution vulnerability in libxml2 could enable an attacker using a specially crafted A remote code execution vulnerability in libxml2 could enable an attacker using a specially crafted file to execute arbitrary code within the context of an unprivileged process. This issue is rated as High due to the possibility of remote code execution in an application that uses this library. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1,

CVE-2017-0540 [HIGH] CWE-119 CVE-2017-0540: A remote code execution vulnerability in libhevc in Mediaserver could enable an attacker using a spe A remote code execution vulnerability in libhevc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 5.0.2, 5.1.1,

CVE-2017-0474 [HIGH] CWE-119 CVE-2017-0474: A remote code execution vulnerability in Mediaserver could enable an attacker using a specially craf A remote code execution vulnerability in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 7.0, 7.1.1. Android ID: A

CVE-2020-0181 [HIGH] CWE-190 CVE-2020-0181: In exif_data_load_data_thumbnail of exif-data.c, there is a possible denial of service due to an int In exif_data_load_data_thumbnail of exif-data.c, there is a possible denial of service due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-145075076