Google Inc Android vulnerabilities

CVE-2018-9492 [HIGH] CWE-863 CVE-2018-9492: In checkGrantUriPermissionLocked of ActivityManagerService.java, there is a possible permissions byp In checkGrantUriPermissionLocked of ActivityManagerService.java, there is a possible permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-8.0 Android-8.1 Android-9.0 Android ID: A-111934948

CVE-2018-9525 [HIGH] CVE-2018-9525: In the AndroidManifest.xml file defining the SliceBroadcastReceiver handler for com.android.settings In the AndroidManifest.xml file defining the SliceBroadcastReceiver handler for com.android.settings.slice.action.WIFI_CHANGED, there is a possible permissions bypass due to a confused deputy. This could lead to local escalation of privilege, allowing a local attacker to change device settings, with no additional execution privileges needed. User interaction is

CVE-2018-9522 [HIGH] CWE-787 CVE-2018-9522: In the serialization functions of StatsLogEventWrapper.java, there is a possible out-of-bounds write In the serialization functions of StatsLogEventWrapper.java, there is a possible out-of-bounds write due to unnecessary functionality which may be abused. This could lead to local escalation of privilege in the system process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Andr

CVE-2017-13293 [HIGH] CWE-787 CVE-2017-13293: In the nfc_hci_cmd_received() function of core.c, there is a possible out of bounds write due to a m In the nfc_hci_cmd_received() function of core.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-62679701.

CVE-2018-9547 [HIGH] CWE-20 CVE-2018-9547: In unflatten of GraphicBuffer.cpp, there is a possible bad fd close due to improper input validation In unflatten of GraphicBuffer.cpp, there is a possible bad fd close due to improper input validation. This could lead to local escalation of privilege in the system server with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-8.1 Android-9. Android ID: A-114223584.

CVE-2018-9526 [HIGH] CWE-200 CVE-2018-9526: In device configuration data, there is an improperly configured setting. This could lead to remote d In device configuration data, there is an improperly configured setting. This could lead to remote disclosure of device location. User interaction is not needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-112159033

CVE-2018-9567 [HIGH] CVE-2018-9567: On Pixel devices there is a bug causing verified boot to show the same certificate fingerprint despi On Pixel devices there is a bug causing verified boot to show the same certificate fingerprint despite using different signing keys. This may lead to local escalation of privilege if people are relying on those fingerprints to determine what version of the OS the device is running, with System execution privileges needed. User interaction is not needed for expl

CVE-2016-10233 [CRITICAL] CWE-264 CVE-2016-10233: An elevation of privilege vulnerability in the Qualcomm video driver. Product: Android. Versions: An An elevation of privilege vulnerability in the Qualcomm video driver. Product: Android. Versions: Android kernel. Android ID: A-34389926. References: QC-CR#897452.

CVE-2017-13232 [HIGH] CWE-200 CVE-2017-13232: In audioserver, there is an out-of-bounds write due to a log statement using %s with an array that m In audioserver, there is an out-of-bounds write due to a log statement using %s with an array that may not be NULL terminated. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Andro

CVE-2017-13280 [HIGH] CWE-125 CVE-2017-13280: In the FrameSequence_gif::FrameSequence_gif function of libframesequence, there is a out of bounds r In the FrameSequence_gif::FrameSequence_gif function of libframesequence, there is a out of bounds read due to a missing bounds check. This could lead to a remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Androi

CVE-2017-0822 [CRITICAL] CVE-2017-0822: An elevation of privilege vulnerability in the Android system (camera). Product: Android. Versions: An elevation of privilege vulnerability in the Android system (camera). Product: Android. Versions: 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63787722.

CVE-2017-0828 [CRITICAL] CVE-2017-0828: An elevation of privilege vulnerability in the Huawei bootloader. Product: Android. Versions: Androi An elevation of privilege vulnerability in the Huawei bootloader. Product: Android. Versions: Android kernel. Android ID: A-34622855.

CVE-2017-0763 [HIGH] CVE-2017-0763: A remote code execution vulnerability in the Android media framework (libhevc). Product: Android. Ve A remote code execution vulnerability in the Android media framework (libhevc). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62534693.

CVE-2017-0753 [HIGH] CVE-2017-0753: A remote code execution vulnerability in the Android libraries (libgdx). Product: Android. Versions: A remote code execution vulnerability in the Android libraries (libgdx). Product: Android. Versions: 7.1.1, 7.1.2, 8.0. Android ID: A-62218744.

CVE-2017-0759 [HIGH] CWE-755 CVE-2017-0759: A remote code execution vulnerability in the Android media framework (libstagefright). Product: Andr A remote code execution vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36715268.

CVE-2017-0766 [HIGH] CVE-2017-0766: A remote code execution vulnerability in the Android media framework (libjhead). Product: Android. V A remote code execution vulnerability in the Android media framework (libjhead). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37776688.

CVE-2017-0762 [HIGH] CWE-755 CVE-2017-0762: A remote code execution vulnerability in the Android media framework (libhevc). Product: Android. Ve A remote code execution vulnerability in the Android media framework (libhevc). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-62214264.

CVE-2017-0765 [HIGH] CVE-2017-0765: A remote code execution vulnerability in the Android media framework (libstagefright). Product: Andr A remote code execution vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62872863.

CVE-2017-0757 [HIGH] CWE-119 CVE-2017-0757: A remote code execution vulnerability in the Android media framework (libavc). Product: Android. Ver A remote code execution vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36006815.

CVE-2017-0476 [HIGH] CWE-119 CVE-2017-0476: A remote code execution vulnerability in AOSP Messaging could enable an attacker using a specially c A remote code execution vulnerability in AOSP Messaging could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as High due to the possibility of remote code execution within the context of an unprivileged process. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. An