Google Inc Android vulnerabilities

CVE-2018-9505 [MEDIUM] CWE-125 CVE-2018-9505: In mca_ccb_hdl_req of mca_cact.cc, there is a possible out of bounds read due to a missing bounds ch In mca_ccb_hdl_req of mca_cact.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-

CVE-2017-13305 [HIGH] CWE-125 CVE-2017-13305: A information disclosure vulnerability in the Upstream kernel encrypted-keys. Product: Android. Vers A information disclosure vulnerability in the Upstream kernel encrypted-keys. Product: Android. Versions: Android kernel. Android ID: A-70526974.

CVE-2018-9493 [MEDIUM] CWE-89 CVE-2018-9493: In the content provider of the download manager, there is a possible SQL injection due to improper i In the content provider of the download manager, there is a possible SQL injection due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 A

CVE-2017-0705 [MEDIUM] CVE-2017-0705: A elevation of privilege vulnerability in the Broadcom wi-fi driver. Product: Android. Versions: And A elevation of privilege vulnerability in the Broadcom wi-fi driver. Product: Android. Versions: Android kernel. Android ID: A-34973477. References: B-RB#119898.

CVE-2017-0706 [MEDIUM] CWE-119 CVE-2017-0706: A elevation of privilege vulnerability in the Broadcom wi-fi driver. Product: Android. Versions: And A elevation of privilege vulnerability in the Broadcom wi-fi driver. Product: Android. Versions: Android kernel. Android ID: A-35195787. References: B-RB#120532.

CVE-2017-13235 [MEDIUM] CWE-476 CVE-2017-13235: A other vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, A other vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. ID: A-68342866.

CVE-2018-9519 [MEDIUM] CWE-362 CVE-2018-9519: In easelcomm_hw_build_scatterlist, there is a possible out of bounds write due to a race condition. In easelcomm_hw_build_scatterlist, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege with System privileges required. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-69808833.

CVE-2017-0792 [MEDIUM] CWE-200 CVE-2017-0792: A information disclosure vulnerability in the Broadcom wi-fi driver. Product: Android. Versions: And A information disclosure vulnerability in the Broadcom wi-fi driver. Product: Android. Versions: Android kernel. Android ID: A-37305578. References: B-V2017052301.

CVE-2016-8467 [MEDIUM] CWE-264 CVE-2016-8467: An elevation of privilege vulnerability in the bootloader could enable a local attacker to execute a An elevation of privilege vulnerability in the bootloader could enable a local attacker to execute arbitrary modem commands on the device. This issue is rated as High because it is a local permanent denial of service (device interoperability: completely permanent or requiring re-flashing the entire operating system). Product: Android. Versions: N/A. A

CVE-2018-9499 [MEDIUM] CWE-908 CVE-2018-9499: In readVector of iCrypto.cpp, there is a possible invalid read due to uninitialized data. This could In readVector of iCrypto.cpp, there is a possible invalid read due to uninitialized data. This could lead to local information disclosure from the DRM server with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android

CVE-2017-0880 [MEDIUM] CVE-2017-0880: A denial of service vulnerability in the Android media framework (libskia). Product: Android. Versio A denial of service vulnerability in the Android media framework (libskia). Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID A-65646012.

CVE-2017-13148 [MEDIUM] CWE-20 CVE-2017-13148: A denial of service vulnerability in the Android media framework (libmpeg2). Product: Android. Versi A denial of service vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-65717533.

CVE-2017-0874 [MEDIUM] CWE-20 CVE-2017-0874: A denial of service vulnerability in the Android media framework (libavc). Product: Android. Version A denial of service vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-63315932.

CVE-2017-0873 [MEDIUM] CWE-20 CVE-2017-0873: A denial of service vulnerability in the Android media framework (libmpeg2). Product: Android. Versi A denial of service vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-63316255.

CVE-2017-0783 [MEDIUM] CWE-200 CVE-2017-0783: A information disclosure vulnerability in the Android system (bluetooth). Product: Android. Versions A information disclosure vulnerability in the Android system (bluetooth). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63145701.

CVE-2017-13290 [MEDIUM] CWE-125 CVE-2017-13290: In sdp_server_handle_client_req of sdp_server.cc, there is an out of bounds read due to a missing bo In sdp_server_handle_client_req of sdp_server.cc, there is an out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-69384124.

CVE-2016-8397 [MEDIUM] CWE-200 CVE-2016-8397: An information disclosure vulnerability in the NVIDIA video driver could enable a local malicious ap An information disclosure vulnerability in the NVIDIA video driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it could be used to access sensitive data without explicit user permission. Product: Android. Versions: Kernel-3.10. Android ID: A-31385953. References: N-CVE

CVE-2016-8400 [MEDIUM] CWE-200 CVE-2016-8400: An information disclosure vulnerability in the NVIDIA librm library (libnvrm) could enable a local m An information disclosure vulnerability in the NVIDIA librm library (libnvrm) could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: Kernel-3.18. Android ID: A-31251599. References: N-CV

CVE-2018-9566 [MEDIUM] CWE-125 CVE-2018-9566: In process_service_search_rsp of sdp_discovery.c, there is a possible out of bounds read due to a mi In process_service_search_rsp of sdp_discovery.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure when connecting to a malicious Bluetooth device with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 And

CVE-2017-0424 [MEDIUM] CWE-200 CVE-2017-0424: An information disclosure vulnerability in AOSP Messaging could enable a remote attacker using a spe An information disclosure vulnerability in AOSP Messaging could enable a remote attacker using a special crafted file to access data outside of its permission levels. This issue is rated as Moderate because it is a general bypass for a user level defense in depth or exploit mitigation technology in a privileged process. Product: Android. Versions: 6.0