Google Android vulnerabilities

CVE-2022-20197 [HIGH] CVE-2022-20197: In recycle of Parcel.java, there is a possible way to start foreground activity from background due In recycle of Parcel.java, there is a possible way to start foreground activity from background due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-208279300

CVE-2022-20207 [HIGH] CVE-2022-20207: In static definitions of GattServiceConfig.java, there is a possible permission bypass due to an ins In static definitions of GattServiceConfig.java, there is a possible permission bypass due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-185513714

CVE-2022-20192 [HIGH] CVE-2022-20192: In grantEmbeddedWindowFocus of WindowManagerService.java, there is a possible way to change an input In grantEmbeddedWindowFocus of WindowManagerService.java, there is a possible way to change an input channel for embedded hierarchy due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-2159

CVE-2021-25511 [HIGH] CWE-20 CVE-2021-25511: An improper validation vulnerability in FilterProvider prior to SMR Dec-2021 Release 1 allows attack An improper validation vulnerability in FilterProvider prior to SMR Dec-2021 Release 1 allows attackers to write arbitrary files via a path traversal vulnerability.

CVE-2022-48384 [HIGH] CWE-862 CVE-2022-48384: In srtd service, there is a possible missing permission check. This could lead to local escalation o In srtd service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.

CVE-2022-20099 [HIGH] CWE-787 CVE-2022-20099: In aee daemon, there is a possible out of bounds write due to improper input validation. This could In aee daemon, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06296442; Issue ID: ALPS06296442.

CVE-2022-20109 [HIGH] CVE-2022-20109: In ion, there is a possible use after free due to improper update of reference count. This could lea In ion, there is a possible use after free due to improper update of reference count. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06399915; Issue ID: ALPS06399915.

CVE-2021-39752 [HIGH] CVE-2021-39752: In Bubbles, there is a possible way to interfere with Bubbles due to a permissions bypass. This coul In Bubbles, there is a possible way to interfere with Bubbles due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-202756848

CVE-2021-0923 [HIGH] CWE-862 CVE-2021-0923: In createOrUpdate of Permission.java, there is a possible way to gain internal permissions due to a In createOrUpdate of Permission.java, there is a possible way to gain internal permissions due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-195338390

CVE-2022-20356 [HIGH] CWE-20 CVE-2022-20356: In shouldAllowFgsWhileInUsePermissionLocked of ActiveServices.java, there is a possible way to start In shouldAllowFgsWhileInUsePermissionLocked of ActiveServices.java, there is a possible way to start foreground service from background due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 An

CVE-2022-21743 [HIGH] CWE-190 CVE-2022-21743: In ion, there is a possible use after free due to an integer overflow. This could lead to local esca In ion, there is a possible use after free due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06371108; Issue ID: ALPS06371108.

CVE-2021-39767 [HIGH] CWE-1188 CVE-2021-39767: In miniadb, there is a possible way to get read/write access to recovery system properties due to an In miniadb, there is a possible way to get read/write access to recovery system properties due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-201308542

CVE-2021-39763 [HIGH] CWE-20 CVE-2021-39763: In Settings, there is a possible way to make the user enable WiFi due to improper input validation. In Settings, there is a possible way to make the user enable WiFi due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-199176115

CVE-2021-39759 [HIGH] CWE-190 CVE-2021-39759: In libstagefright, there is a possible out of bounds write due to an integer overflow. This could le In libstagefright, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-180200830

CVE-2021-39662 [HIGH] CWE-862 CVE-2021-39662: In checkUriPermission of MediaProvider.java , there is a possible way to gain access to the content In checkUriPermission of MediaProvider.java , there is a possible way to gain access to the content of media provider collections due to a missing permission check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12Androi

CVE-2024-31310 [HIGH] CWE-20 CVE-2024-31310: In newServiceInfoLocked of AutofillManagerServiceImpl.java, there is a possible way to hide an enabl In newServiceInfoLocked of AutofillManagerServiceImpl.java, there is a possible way to hide an enabled Autofill service app in the Autofill service settings due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

CVE-2024-43087 [HIGH] CWE-862 CVE-2024-43087: In getInstalledAccessibilityPreferences of AccessibilitySettings.java, there is a possible way to hi In getInstalledAccessibilityPreferences of AccessibilitySettings.java, there is a possible way to hide an enabled accessibility service in the accessibility service settings due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

CVE-2022-48383 [HIGH] CWE-862 CVE-2022-48383: .In srtd service, there is a possible missing permission check. This could lead to local escalation .In srtd service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.

CVE-2022-20415 [HIGH] CVE-2022-20415: In handleFullScreenIntent of StatusBarNotificationActivityStarter.java, there is a possible bypass o In handleFullScreenIntent of StatusBarNotificationActivityStarter.java, there is a possible bypass of the restriction of starting activity from background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: A

CVE-2022-20297 [HIGH] CVE-2022-20297: In Settings, there is a possible way to bypass factory reset protections due to a logic error in the In Settings, there is a possible way to bypass factory reset protections due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-201561699