Google Android vulnerabilities

CVE-2015-3874 [CRITICAL] CWE-119 CVE-2015-3874: The Sonivox components in Android before 5.1.1 LMY48T allow remote attackers to execute arbitrary co The Sonivox components in Android before 5.1.1 LMY48T allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bugs 23335715, 23307276, and 23286323.

CVE-2016-6699 [HIGH] CWE-119 CVE-2016-6699: A remote code execution vulnerability in libstagefright in Mediaserver in Android 7.0 before 2016-11 A remote code execution vulnerability in libstagefright in Mediaserver in Android 7.0 before 2016-11-01 could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. An

CVE-2018-9550 [HIGH] CWE-787 CVE-2018-9550: In CAacDecoder_Init of aacdecoder.cpp, there is a possible out of bounds write due to a missing boun In CAacDecoder_Init of aacdecoder.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-112660981.

CVE-2018-9527 [HIGH] CWE-787 CVE-2018-9527: In vorbis_book_decodev_set of codebook.c there is a possible out of bounds write due to missing boun In vorbis_book_decodev_set of codebook.c there is a possible out of bounds write due to missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android

CVE-2019-20613 [HIGH] CWE-89 CVE-2019-20613: An issue was discovered on Samsung mobile devices with N(7.x) and O(8.x) software. There is time-bas An issue was discovered on Samsung mobile devices with N(7.x) and O(8.x) software. There is time-based SQL injection in Contacts. The Samsung ID is SVE-2018-13452 (March 2019).

CVE-2019-2094 [HIGH] CWE-787 CVE-2019-2094: In parseMPEGCCData of NuPlayerCCDecoder.cpp, there is a possible out of bounds write due to missing In parseMPEGCCData of NuPlayerCCDecoder.cpp, there is a possible out of bounds write due to missing bounds checks. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Andr

CVE-2018-9549 [HIGH] CWE-787 CVE-2018-9549: In lppTransposer of lpp_tran.cpp there is a possible out of bounds write due to missing bounds check In lppTransposer of lpp_tran.cpp there is a possible out of bounds write due to missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-11

CVE-2019-2176 [HIGH] CWE-787 CVE-2019-2176: In ihevcd_parse_buffering_period_sei of ihevcd_parse_headers.c in Android 8.0, 8.1 and 9, there is a In ihevcd_parse_buffering_period_sei of ihevcd_parse_headers.c in Android 8.0, 8.1 and 9, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.

CVE-2019-2108 [HIGH] CWE-787 CVE-2019-2108: In ihevcd_ref_list of ihevcd_ref_list.c in Android 10, there is a possible out of bounds write due t In ihevcd_ref_list of ihevcd_ref_list.c in Android 10, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.

CVE-2017-13192 [HIGH] CWE-835 CVE-2017-13192: In the ihevcd_parse_slice_header function of ihevcd_parse_slice_header.c a slice address of zero aft In the ihevcd_parse_slice_header function of ihevcd_parse_slice_header.c a slice address of zero after the first slice could result in an infinite loop. This could lead to a remote denial of service of a critical system process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions:

CVE-2017-13191 [HIGH] CWE-835 CVE-2017-13191: In the ihevcd_decode function of ihevcd_decode.c, there is an infinite loop due to an incomplete fra In the ihevcd_decode function of ihevcd_decode.c, there is an infinite loop due to an incomplete frame error. This could lead to a remote denial of service of a critical system process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0,

CVE-2021-0393 [HIGH] CWE-190 CVE-2021-0393: In Scanner::LiteralBuffer::NewCapacity of scanner.cc, there is a possible out of bounds write due to In Scanner::LiteralBuffer::NewCapacity of scanner.cc, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution if an attacker can supply a malicious PAC file, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1

CVE-2018-9362 [HIGH] CWE-20 CVE-2018-9362: In processMessagePart of InboundSmsHandler.java, there is a possible remote denial of service due to In processMessagePart of InboundSmsHandler.java, there is a possible remote denial of service due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-6.0 Android-6.0.1 Android-7.0 Android-7.1.1 Android-

CVE-2014-7920 [CRITICAL] CWE-264 CVE-2014-7920: mediaserver in Android 2.2 through 5.x before 5.1 allows attackers to gain privileges. NOTE: This i mediaserver in Android 2.2 through 5.x before 5.1 allows attackers to gain privileges. NOTE: This is a different vulnerability than CVE-2014-7921.

CVE-2021-0673 [HIGH] CWE-862 CVE-2021-0673: In Audio Aurisys HAL, there is a possible permission bypass due to a missing permission check. This In Audio Aurisys HAL, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05977326; Issue ID: ALPS05977326.

CVE-2011-2344 [CRITICAL] CWE-310 CVE-2011-2344: Android Picasa in Android 3.0 and 2.x through 2.3.4 uses a cleartext HTTP session when transmitting Android Picasa in Android 3.0 and 2.x through 2.3.4 uses a cleartext HTTP session when transmitting the authToken obtained from ClientLogin, which allows remote attackers to gain privileges and access private pictures and web albums by sniffing the token from connections with picasaweb.google.com.

CVE-2021-0675 [HIGH] CWE-787 CVE-2021-0675: In alac decoder, there is a possible out of bounds write due to an incorrect bounds check. This coul In alac decoder, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06064258; Issue ID: ALPS06064258.

CVE-2019-9254 [HIGH] CWE-20 CVE-2019-9254: In readArgumentList of zygote.java in Android 10, there is a possible command injection due to impro In readArgumentList of zygote.java in Android 10, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2020-0130 [HIGH] CWE-20 CVE-2020-0130: In screencap, there is a possible command injection due to improper input validation. This could lea In screencap, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege in a system process with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-123230379

CVE-2020-0037 [HIGH] CWE-125 CVE-2020-0037: In rw_i93_sm_set_read_only of rw_i93.cc, there is a possible out of bounds read due to a missing bou In rw_i93_sm_set_read_only of rw_i93.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure over NFC with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-143106