Google Android vulnerabilities

CVE-2022-20491 [HIGH] CWE-1284 CVE-2022-20491: In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissio In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-

CVE-2022-20495 [HIGH] CWE-276 CVE-2022-20495: In getEnabledAccessibilityServiceList of AccessibilityManager.java, there is a possible way to hide In getEnabledAccessibilityServiceList of AccessibilityManager.java, there is a possible way to hide an accessibility service due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 An

CVE-2020-0440 [HIGH] CWE-862 CVE-2020-0440: In createVirtualDisplay of DisplayManagerService.java, there is a possible way to create a trusted v In createVirtualDisplay of DisplayManagerService.java, there is a possible way to create a trusted virtual display due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-162627132

CVE-2022-20484 [HIGH] CWE-770 CVE-2022-20484: In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissio In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-1

CVE-2022-20480 [HIGH] CWE-770 CVE-2022-20480: In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissio In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-1

CVE-2020-0115 [HIGH] CWE-863 CVE-2020-0115: In verifyIntentFiltersIfNeeded of PackageManagerService.java, there is a possible settings bypass al In verifyIntentFiltersIfNeeded of PackageManagerService.java, there is a possible settings bypass allowing an app to become the default handler for arbitrary domains. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Andr

CVE-2021-0310 [HIGH] CWE-416 CVE-2021-0310: In LazyServiceRegistrar of LazyServiceRegistrar.cpp, there is a possible memory corruption due to a In LazyServiceRegistrar of LazyServiceRegistrar.cpp, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-11; Android ID: A-170212632.

CVE-2020-0275 [HIGH] CWE-276 CVE-2020-0275: In MediaProvider, there is a possible way to access ContentResolver and MediaStore entries the app s In MediaProvider, there is a possible way to access ContentResolver and MediaStore entries the app shouldn't have access to due to a permissions bypass. This could lead to local escalation of privilege, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-150507

CVE-2021-39626 [HIGH] CWE-610 CVE-2021-39626: In onAttach of ConnectedDeviceDashboardFragment.java, there is a possible permission bypass due to a In onAttach of ConnectedDeviceDashboardFragment.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege in Bluetooth settings with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9

CVE-2020-0046 [HIGH] CWE-787 CVE-2020-0046: In DrmPlugin::releaseSecureStops of DrmPlugin.cpp, there is a possible out of bounds write due to a In DrmPlugin::releaseSecureStops of DrmPlugin.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-137284652

CVE-2022-20506 [HIGH] CWE-862 CVE-2022-20506: In onCreate of WifiDialogActivity.java, there is a missing permission check. This could lead to loca In onCreate of WifiDialogActivity.java, there is a missing permission check. This could lead to local escalation of privilege from a guest user with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-226133034

CVE-2022-38670 [HIGH] CWE-862 CVE-2022-38670: In soundrecorder service, there is a missing permission check. This could lead to elevation of privi In soundrecorder service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additional execution privileges needed.

CVE-2022-2985 [HIGH] CWE-862 CVE-2022-2985: In music service, there is a missing permission check. This could lead to elevation of privilege in In music service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additional execution privileges needed.

CVE-2022-38669 [HIGH] CWE-862 CVE-2022-38669: In soundrecorder service, there is a missing permission check. This could lead to elevation of privi In soundrecorder service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additional execution privileges needed.

CVE-2020-0346 [HIGH] CWE-190 CVE-2020-0346: In Mediaserver, there is a possible out of bounds write due to an integer overflow. This could lead In Mediaserver, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege if integer sanitization were not enabled (which it is by default), with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-147002762

CVE-2019-9407 [HIGH] CVE-2019-9407: In notification management of the service manager, there is a possible permissions bypass. This coul In notification management of the service manager, there is a possible permissions bypass. This could lead to local escalation of privilege by preventing user notification, with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-112434609

CVE-2022-20522 [HIGH] CWE-862 CVE-2022-20522: In getSlice of ProviderModelSlice.java, there is a missing permission check. This could lead to loca In getSlice of ProviderModelSlice.java, there is a missing permission check. This could lead to local escalation of privilege from the guest user with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-227470877

CVE-2020-0120 [HIGH] CWE-787 CVE-2020-0120: In notifyErrorForPendingRequests of QCamera3HWI.cpp, there is a possible out of bounds write due to In notifyErrorForPendingRequests of QCamera3HWI.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-149995442

CVE-2022-38698 [HIGH] CWE-862 CVE-2022-38698: In messaging service, there is a missing permission check. This could lead to elevation of privilege In messaging service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additional execution privileges needed.

CVE-2022-39107 [HIGH] CWE-862 CVE-2022-39107: In Soundrecorder service, there is a missing permission check. This could lead to elevation of privi In Soundrecorder service, there is a missing permission check. This could lead to elevation of privilege in Soundrecorder service with no additional execution privileges needed.