Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um seine Privilegien zu erweitern, einen Denial-of-Service-Zustand zu verursachen, beliebigen Code auszuführen und vertrauliche Informationen offenzulegen.
Product
Das Android Betriebssystem von Google ist eine quelloffene Plattform für mobile Geräte. Die Basis bildet der Linux-Kernel.
Vulnerabilities 225
-
Critical 9.8
In toLanguageTag of LocaleListCache.cpp, there is a possible out of bounds read due to an incorrect bounds check. This …
-
Critical 9.8CVE-2022-20473 Public exploit
In toLanguageTag of LocaleListCache.cpp, there is a possible out of bounds read due to an incorrect bounds check. This …
-
Critical 9.8
Product: AndroidVersions: Android kernelAndroid ID: A-235292841References: N/A
-
High 8.8
In avdt_msg_asmbl of avdt_msg.cc, there is a possible out of bounds write due to a missing bounds check. This could lea…
-
High 8.8
In avct_lcb_msg_asmbl of avct_lcb_act.cc, there is a possible out of bounds write due to a missing bounds check. This c…
-
High 8.8CVE-2022-20607 Public exploit
In the Pixel cellular firmware, there is a possible out of bounds write due to a missing bounds check. This could lead …
-
High 8.8
In cellular modem firmware, there is a possible out of bounds read due to a missing bounds check. This could lead to re…
-
High 8.4
Possible memory corruption in kernel while performing memory access due to hypervisor not correctly invalidated the pro…
-
High 8.4
Memory corruption in MODEM UIM due to usage of out of range pointer offset while decoding command from card in Snapdrag…
-
High 8.4
Memory corruption in MODEM due to Improper Validation of Array Index while processing GSTK Proactive commands in Snapdr…
-
High 8.4
Memory corruption in i2c buses due to improper input validation while reading address configuration from i2c driver in …
-
High 8.4
Memory corruption in SPI buses due to improper input validation while reading address configuration from spi buses in S…
-
High 8.2
Information disclosure due to buffer over-read in WLAN firmware while parsing security context info attributes. in Snap…
-
High 8.2
Information disclosure due to buffer over-read in Bluetooth HOST while pairing and connecting A2DP. in Snapdragon Auto,…
-
High 7.8
Integer Overflow or Wraparound vulnerability in io_uring of Linux Kernel allows local attacker to cause memory corrupti…
-
High 7.8CVE-2022-20470 Public exploit
In bindRemoteViewsService of AppWidgetServiceImpl.java, there is a possible way to bypass background activity launch du…
-
High 7.8CVE-2022-20474 Public exploit
In readLazyValue of Parcel.java, there is a possible loading of arbitrary code into the System Settings app due to a co…
-
High 7.8
In test of ResetTargetTaskHelper.java, there is a possible hijacking of any app which sets allowTaskReparenting="true" …
-
High 7.8
In shouldHideNotification of KeyguardNotificationVisibilityProvider.kt, there is a possible way to show hidden notifica…
-
High 7.8
In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to …
-
High 7.8
In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to …
-
High 7.8
In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to …
-
High 7.8
In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to …
-
High 7.8
In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to …
-
High 7.8
In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to …
-
High 7.8
In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to …
-
High 7.8
In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to …
-
High 7.8
In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to …
-
High 7.8
In getEnabledAccessibilityServiceList of AccessibilityManager.java, there is a possible way to hide an accessibility se…
-
High 7.8
In onCreate of WifiDppConfiguratorActivity.java, there is a possible way for a guest user to add a WiFi configuration d…
-
High 7.8
In onCreate of WifiDialogActivity.java, there is a missing permission check. This could lead to local escalation of pri…
-
High 7.8
In onMulticastListUpdateNotificationReceived of UwbEventManager.java, there is a possible arbitrary code execution due …
-
High 7.8
In onAttach of ConfigureWifiSettings.java, there is a possible way for a guest user to change WiFi settings due to a pe…
-
High 7.8
In navigateUpTo of Task.java, there is a possible way to launch an intent handler with a mismatched intent due to impro…
-
High 7.8
In onCreate of various files, there is a possible tapjacking/overlay attack. This could lead to local escalation of pri…
-
High 7.8
In getSlice of ProviderModelSlice.java, there is a missing permission check. This could lead to local escalation of pri…
-
High 7.8
In compose of Vibrator.cpp, there is a possible arbitrary code execution due to a use after free. This could lead to lo…
-
High 7.8
In SurfaceFlinger::doDump of SurfaceFlinger.cpp, there is possible arbitrary code execution due to a use after free. Th…
-
High 7.8
In multiple functions of AdapterService.java, there is a possible way to manipulate Bluetooth state due to a missing pe…
-
High 7.8
In setParameter of EqualizerEffect.cpp, there is a possible out of bounds write due to improper input validation. This …
-
High 7.8
In Multiple Locations, there is a possibility to launch arbitrary protected activities due to a confused deputy. This c…
-
High 7.8
In TBD of aud_hal_tunnel.c, there is a possible memory corruption due to a use after free. This could lead to local esc…
-
High 7.8
In l2cap_chan_put of l2cap_core, there is a possible use after free due to improper locking. This could lead to local e…
-
High 7.8
In (TBD) of (TBD), there is a possible way to corrupt kernel memory due to a use after free. This could lead to local e…
-
High 7.8
In ppmp_unprotect_mfcfw_buf of drm_fw.c, there is a possible out of bounds write due to improper input validation. This…
-
High 7.8
In page_number of shared_mem.c, there is a possible code execution in secure world due to improper input validation. Th…
-
High 7.8
In valid_out_of_special_sec_dram_addr of drm_access_control.c, there is a possible EoP due to improper input validation…
-
High 7.8
In valid_out_of_special_sec_dram_addr of drm_access_control.c, there is a possible EoP due to improper input validation…
-
High 7.8
In ppmp_validate_wsm of drm_fw.c, there is a possible EoP due to improper input validation. This could lead to local es…
-
High 7.8
In ppmpu_set of ppmpu.c, there is a possible EoP due to an integer overflow. This could lead to local escalation of pri…
-
High 7.8
In sec_media_protect of media.c, there is a possible EoP due to an integer overflow. This could lead to local escalatio…
-
High 7.8
In TBD of TBD, there is a possible out of bounds write due to memory corruption. This could lead to local escalation of…
-
High 7.8
In deletePackageVersionedInternal of DeletePackageHelper.java, there is a possible way to bypass carrier restrictions d…
-
High 7.8
In mmu_map_for_fw of gs_ldfw_load.c, there is a possible mitigation bypass due to Permissive Memory Allocation. This co…
-
High 7.8
In trusty_ffa_mem_reclaim of shared-mem-smcall.c, there is a possible privilege escalation due to improper input valida…
-
High 7.7
In sensor driver, there is a possible buffer overflow due to a missing bounds check. This could lead to local denial of…
-
High 7.5
In several functions that parse avrc response in avrc_pars_ct.cc and related files, there are possible out of bounds re…
-
High 7.5
In rw_t3t_act_handle_check_ndef_rsp of rw_t3t.cc, there is a possible out of bounds read due to an integer overflow. Th…
-
High 7.5
In bindArtworkAndColors of MediaControlPanel.java, there is a possible way to crash the phone due to improper input val…
-
High 7.5
Product: AndroidVersions: Android kernelAndroid ID: A-212623833References: N/A
-
High 7.5
Product: AndroidVersions: Android kernelAndroid ID: A-204541506References: N/A
-
High 7.5
Product: AndroidVersions: Android kernelAndroid ID: A-211081867References: N/A
-
High 7.5
In SAECOMM_CopyBufferBytes of SAECOMM_Utility.c, there is a possible out of bounds read due to an incorrect bounds chec…
-
High 7.5
Denial of service in MODEM due to reachable assertion while processing SIB1 with invalid Bandwidth in Snapdragon Mobile
-
High 7.5
Denial of service in MODEM due to reachable assertion while processing configuration from network in Snapdragon Mobile
-
High 7.5
Denial of service in Modem module due to improper authorization while error handling in Snapdragon Auto, Snapdragon Com…
-
High 7.5
Denial of service in Modem due to reachable assertion in Snapdragon Mobile
-
High 7.5
Denial of service in Modem due to reachable assertion while processing SIB1 with invalid SCS and bandwidth settings in …
-
High 7.5
Denial of service in Modem due to reachable assertion while processing the common config procedure in Snapdragon Auto, …
-
High 7.5
Denial of service in modem due to reachable assertion while processing reconfiguration message in Snapdragon Auto, Snap…
-
High 7.5
Transient DOS due to loop with unreachable exit condition in WLAN while processing an incoming FTM frames. in Snapdrago…
-
High 7.5
In sms_GetTpUdlIe of sms_PduCodec.c, there is a possible out of bounds read due to a missing bounds check. This could l…
-
High 7.5
In cd_SsParseMsg of cd_SsCodec.c, there is a possible crash due to a missing null check. This could lead to remote deni…
-
High 7.4
In pppol2tp_create of l2tp_ppp.c, there is a possible use after free due to a race condition. This could lead to local …
-
High 7.3
In onCreate of ReviewPermissionsActivity.java, there is a possible way to grant permissions for a separate app with API…
-
High 7.3
In onCreate of EnableAccountPreferenceActivity.java, there is a possible way to mislead the user into enabling a malici…
-
High 7.2
In SetDecompContextDb of RohcDeCompContextOfRbId.cpp, there is a possible out of bounds write due to a missing bounds c…
-
High 7.0
In TBD of TBD, there is a possible way to archive arbitrary code execution in kernel due to a race condition. This coul…
-
Medium 6.7
In multiple locations of DreamManagerService.java, there is a missing permission check. This could lead to local escala…
-
Medium 6.7
In openFile of CallLogProvider.java, there is a possible permission bypass due to a path traversal error. This could le…
-
Medium 6.7
In mapGrantorDescr of MessageQueueBase.h, there is a possible out of bounds write due to a missing bounds check. This c…
-
Medium 6.7
In acquireFabricatedOverlayIterator, nextFabricatedOverlayInfos, and releaseFabricatedOverlayIterator of Idmap2Service.…
-
Medium 6.7
In parameterToHal of Effect.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead…
-
Medium 6.7
In getCurrentConfigImpl of Effect.cpp, there is a possible out of bounds write due to a missing bounds check. This coul…
-
Medium 6.7
In authToken2AidlVec of KeyMintUtils.cpp, there is a possible out of bounds write due to an incorrect bounds check. Thi…
-
Medium 6.7
In removeEventHubDevice of InputDevice.cpp, there is a possible OOB read due to a use after free. This could lead to lo…
-
Medium 6.7
In MessageQueueBase of MessageQueueBase.h, there is a possible out of bounds read due to a missing bounds check. This c…
-
Medium 6.7
In TBD of ufdt_convert, there is a possible out of bounds read due to memory corruption. This could lead to local escal…
-
Medium 6.7
In _ufdt_output_strtab_to_fdt of ufdt_convert.c, there is a possible out of bounds write due to an incorrect bounds che…
-
Medium 6.7
In thermal_cooling_device_stats_update of thermal_sysfs.c, there is a possible out of bounds write due to improper inpu…
-
Medium 6.7
In extract_metadata of dm-android-verity.c, there is a possible way to corrupt kernel memory due to a use after free. T…
-
Medium 6.7
In verity_target of dm-verity-target.c, there is a possible way to modify read-only files due to a missing permission c…
-
Medium 6.7
In externalOnRequest of rilapplication.cpp, there is a possible out of bounds write due to a missing bounds check. This…
-
Medium 6.7
In OemSimAuthRequest::encode of wlandata.cpp, there is a possible out of bounds write due to a missing bounds check. Th…
-
Medium 6.7
In RadioImpl::setGsmBroadcastConfig of ril_service_legacy.cpp, there is a possible stack clash leading to memory corrup…
-
Medium 6.7
In RadioImpl::setCdmaBroadcastConfig of ril_service_legacy.cpp, there is a possible stack clash leading to memory corru…
-
Medium 6.7
In ufdt_do_one_fixup of ufdt_overlay.c, there is a possible out of bounds write due to an incorrect bounds check. This …
-
Medium 6.7
In the Pixel camera driver, there is a possible use after free due to a logic error in the code. This could lead to loc…
-
Medium 6.7
In ppmp_unprotect_mfcfw_buf of drm_fw.c, there is a possible out of bounds write due to improper input validation. This…
-
Medium 6.7
In sysmmu_map of sysmmu.c, there is a possible EoP due to a precondition check failure. This could lead to local escala…
-
Medium 6.7
In updateStart of WirelessCharger.cpp, there is a possible out of bounds write due to a missing bounds check. This coul…
-
Medium 6.7
In sendChunk of WirelessCharger.cpp, there is a possible out of bounds write due to a missing bounds check. This could …
-
Medium 6.7
In Pixel firmware, there is a possible exposure of sensitive memory due to a missing bounds check. This could lead to l…
-
Medium 6.7
Memory corruption in diag due to use after free while processing dci packet in Snapdragon Auto, Snapdragon Compute, Sna…
-
Medium 6.7
In widevine, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalat…
-
Medium 6.7
In widevine, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalat…
-
Medium 6.7
In widevine, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalat…
-
Medium 6.7
In widevine, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalat…
-
Medium 6.7
In keyinstall, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escal…
-
Medium 6.7
In mpu, there is a possible memory corruption due to a logic error. This could lead to local escalation of privilege wi…
-
Medium 6.7
In HexString2Value of util.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead …
-
Medium 6.7
In FacilityLock::Parse of simdata.cpp, there is a possible out of bounds write due to a missing bounds check. This coul…
-
Medium 6.7
In ProtocolMiscBuilder::BuildSetLinkCapaReportCriteria of protocolmiscbuilder.cpp, there is a possible out of bounds wr…
-
Medium 6.7
In CallDialReqData::encodeCallNumber of callreqdata.cpp, there is a possible out of bounds write due to an incorrect bo…
-
Medium 6.7
In ProtocolMiscBuilder::BuildSetSignalReportCriteria of protocolmiscbuilder.cpp, there is a possible out of bounds writ…
-
Medium 6.7
In SimUpdatePbEntry::encode of simdata.cpp, there is a possible out of bounds write due to a missing bounds check. This…
-
Medium 6.7
In ProtocolSimBuilder::BuildSimUpdatePb3gEntry of protocolsimbuilder.cpp, there is a possible out of bounds write due t…
-
Medium 6.7
In ProtocolCallBuilder::BuildSendUssd of protocolcallbuilder.cpp, there is a possible out of bounds write due to a miss…
-
Medium 6.7
In CallDialReqData::encode of callreqdata.cpp, there is a possible out of bounds write due to a missing bounds check. T…
-
Medium 6.7
In StringsRequestData::encode of requestdata.cpp, there is a possible out of bounds read due to improper input validati…
-
Medium 6.7
In EmbmsSessionData::encode of embmsdata.cpp, there is a possible out of bounds write due to a missing bounds check. Th…
-
Medium 6.7
In ProtocolEmbmsBuilder::BuildSetSession of protocolembmsbuilder.cpp, there is a possible out of bounds write due to a …
-
Medium 6.7
In BroadcastSmsConfigsRequestData::encode of smsdata.cpp, there is a possible out of bounds write due to a missing boun…
-
Medium 6.7
In CdmaBroadcastSmsConfigsRequestData::encode of cdmasmsdata.cpp, there is a possible stack clash leading to memory cor…
-
Medium 6.7
In ServiceInterface::HandleRequest of serviceinterface.cpp, there is a possible use after free. This could lead to loca…
-
Medium 6.7
In encode of wlandata.cpp, there is a possible out of bounds write due to improper input validation. This could lead to…
-
Medium 6.7
In fillSetupDataCallInfo_V1_6 of ril_service_1_6.cpp, there is a possible out of bounds write due to an incorrect bound…
-
Medium 6.7
In fillSetupDataCallInfo_V1_6 of ril_service_1_6.cpp, there is a possible out of bounds write due to an incorrect bound…
-
Medium 6.7
In ConvertUtf8ToUcs2 of radio_hal_utils.cpp, there is a possible out of bounds write due to a missing bounds check. Thi…
-
Medium 6.7
In phNxpNciHal_core_initialized of phNxpNciHal.cc, there is a possible out of bounds write due to a missing bounds chec…
-
Medium 6.5
Improper validation of LLM utility timers availability can lead to denial of service in Snapdragon Auto, Snapdragon Com…
-
Medium 6.5
In BNEP_ConnectResp of bnep_api.cc, there is a possible out of bounds read due to an incorrect bounds check. This could…
-
Medium 6.5
In onCreate of LogAccessDialogActivity.java, there is a possible way to bypass a permission check due to a tapjacking/o…
-
Medium 6.1
In IncFs_GetFilledRangesStartingFrom of incfs.cpp, there is a possible out of bounds read due to a missing bounds check…
-
Medium 5.5
In findAllDeAccounts of AccountsDb.java, there is a possible denial of service due to resource exhaustion. This could l…
-
Medium 5.5
In multiple locations of NfcService.java, there is a possible disclosure of NFC tags due to a confused deputy. This cou…
-
Medium 5.5
In applyKeyguardFlags of NotificationShadeWindowControllerImpl.java, there is a possible way to observe the user's pass…
-
Medium 5.5
In SendIncDecRestoreCmdPart2 of NxpMfcReader.cc, there is a possible out of bounds read due to a missing bounds check. …
-
Medium 5.5
In setEnabledSetting of PackageManager.java, there is a possible way to get the device into an infinite reboot loop due…
-
Medium 5.5
In createNotificationChannel of NotificationManager.java, there is a possible way to make the device unusable and requi…
-
Medium 5.5
In setDataSource of initMediaExtractor.cpp, there is a possibility of arbitrary code execution due to a use after free.…
-
Medium 5.5
In validateForCommonR1andR2 of PasspointConfiguration.java, uncaught errors in parsing stored configs could lead to loc…
-
Medium 5.5
In loadFromXml of ShortcutPackage.java, there is a possible crash on boot due to an uncaught exception. This could lead…
-
Medium 5.5
In GetResolvedMethod of entrypoint_utils-inl.h, there is a possible use after free due to a stale cache. This could lea…
-
Medium 5.5
In getNearbyNotificationStreamingPolicy of DevicePolicyManagerService.java, there is a possible way to learn about the …
-
Medium 5.5
In getNearbyAppStreamingPolicy of DevicePolicyManagerService.java, there is a missing permission check. This could lead…
-
Medium 5.5
In decrypt_1_2 of CryptoPlugin.cpp, there is a possible out of bounds read due to a missing bounds check. This could le…
-
Medium 5.5
In onPreferenceClick of AccountTypePreferenceLoader.java, there is a possible way to retrieve protected files from the …
-
Medium 5.5
In getMessagesByPhoneNumber of MmsSmsProvider.java, there is a possible access to restricted tables due to SQL injectio…
-
Medium 5.5
In query of MmsSmsProvider.java, there is a possible access to restricted tables due to SQL injection. This could lead …
-
Medium 5.5
In HalCoreCallback of halcore.cc, there is a possible out of bounds read due to a missing bounds check. This could lead…
-
Medium 5.5
In getSmsRoleHolder of RoleService.java, there is a possible way to determine whether an app is installed, without quer…
-
Medium 5.5
In btif_a2dp_sink_command_ready of btif_a2dp_sink.cc, there is a possible out of bounds read due to a use after free. T…
-
Medium 5.5
Product: AndroidVersions: Android kernelAndroid ID: A-230660904References: N/A
-
Medium 5.5
In sec_sysmmu_info of drm_fw.c, there is a possible out of bounds read due to improper input validation. This could lea…
-
Medium 5.5
In read_ppmpu_info of drm_fw.c, there is a possible out of bounds read due to an incorrect bounds check. This could lea…
-
Medium 5.5
In valid_va_sec_mfc_check of drm_access_control.c, there is a possible information disclosure due to improper input val…
-
Medium 5.5
In ppmpu_set of ppmpu.c, there is a possible information disclosure due to a logic error in the code. This could lead t…
-
Medium 5.5
In ppmp_validate_secbuf of drm_fw.c, there is a possible information disclosure due to improper input validation. This …
-
Medium 5.5
In SAECOMM_SetDcnIdForPlmn of SAECOMM_DbManagement.c, there is a possible out of bounds read due to a missing bounds ch…
-
Medium 5.5
In Pixel cellular firmware, there is a possible out of bounds read due to an incorrect bounds check. This could lead to…
-
Medium 5.5
In Pixel cellular firmware, there is a possible out of bounds read due to a missing bounds check. This could lead to lo…
-
Medium 5.5
Denial of service due to reachable assertion in modem while processing filter rule from application client in Snapdrago…
-
Medium 5.5
In sensor driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denia…
-
Medium 5.5
In face detect driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local …
-
Medium 5.5
In face detect driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local …
-
Medium 5.5
In camera driver, there is a possible memory corruption due to improper locking. This could lead to local denial of ser…
-
Medium 5.5
In camera driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denia…
-
Medium 5.5
In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.
-
Medium 5.5
In a query in MmsSmsProvider.java, there is a possible access to restricted tables due to SQL injection. This could lea…
-
Medium 5.5
In npu driver, there is a memory corruption due to a use after free. This could lead to local denial of service in kern…
-
Medium 5.5
In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.
-
Medium 5.5
In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.
-
Medium 5.3
In strings.xml, there is a possible permission bypass due to a misleading string. This could lead to remote information…
-
Medium 5.0
In sdpu_find_most_specific_service_uuid of sdp_utils.cc, there is a possible way to crash Bluetooth due to a missing nu…
-
Medium 4.9
In SAEMM_MiningCodecTableWithMsgIE of SAEMM_RadioMessageCodec.c, there is a possible out of bounds read due to a missin…
-
Medium 4.7
In audio driver, there is a use after free due to a race condition. This could lead to local denial of service in kerne…
-
Medium 4.7
In wlan driver, there is a race condition, This could lead to local denial of service in wlan services.
-
Medium 4.7
In wlan driver, there is a race condition, This could lead to local denial of service in wlan services.
-
Medium 4.6
In updatePublicMode of NotificationLockscreenUserManagerImpl.java, there is a possible way to reveal sensitive notifica…
-
Medium 4.4
In writeApplicationRestrictionsLAr of UserManagerService.java, there is a possible overwrite of system files due to a p…
-
Medium 4.4
In fdt_path_offset_namelen of fdt_ro.c, there is a possible out of bounds read due to an incorrect bounds check. This c…
-
Medium 4.4
In onOptionsItemSelected of ManageApplications.java, there is a possible bypass of profile owner restrictions due to a …
-
Medium 4.4
In ufdt_get_node_by_path_len of ufdt_convert.c, there is a possible out of bounds read due to a missing bounds check. T…
-
Medium 4.4
In valid_va_secbuf_check of drm_access_control.c, there is a possible ID due to improper input validation. This could l…
-
Medium 4.4
In pop_descriptor_string of BufferDescriptor.h, there is a possible out of bounds read due to a missing bounds check. T…
-
Medium 4.4
In getWpcAuthChallengeResponse of WirelessCharger.cpp, there is a possible out of bounds read due to a missing bounds c…
-
Medium 4.4
In VsimOperationDataExt::encode of vsimdata.cpp, there is a possible out of bounds read due to a missing bounds check. …
-
Medium 4.4
In ProtocolImsBuilder::BuildSetConfig of protocolimsbuilder.cpp, there is a possible out of bounds read due to a missin…
-
Medium 4.4
In MiscService::DoOemSetRtpPktlossThreshold of miscservice.cpp, there is a possible out of bounds read due to a missing…
-
Medium 4.4
In ProtocolSimBuilderLegacy::BuildSimGetGbaAuth of protocolsimbuilderlegacy.cpp, there is a possible out of bounds read…
-
Medium 4.4
In MiscService::DoOemSetTcsFci of miscservice.cpp, there is a possible out of bounds read due to a missing bounds check…
-
Medium 4.4
In DoSetCarrierConfig of miscservice.cpp, there is a possible out of bounds read due to an incorrect bounds check. This…
-
Medium 4.4
In Pixel firmware, there is a possible out of bounds read due to a missing bounds check. This could lead to local infor…
-
Medium 4.4
In Pixel firmware, there is a possible out of bounds read due to a missing bounds check. This could lead to local infor…
-
Medium 4.2
In phNxpNciHal_ioctl of phNxpNciHal.cc, there is a possible out of bounds read due to a missing bounds check. This coul…
-
Low 3.3
In onCreate of AddAppNetworksActivity.java, there is a possible way for a guest user to configure WiFi networks due to …
-
Low 3.3
In enforceVisualVoicemailPackage of PhoneInterfaceManager.java, there is a possible leak of visual voicemail package na…
-
Low 3.3
In CanvasContext::draw of CanvasContext.cpp, there is a possible out of bounds write due to a missing bounds check. Thi…
-
Low 3.3
In findParam of HevcUtils.cpp there is a possible out of bounds read due to a missing bounds check. This could lead to …
-
Low 3.3
In getSlice of WifiSlice.java, there is a possible way to connect a new WiFi network from the guest mode due to a missi…
-
Low 3.3
In registerLocalOnlyHotspotSoftApCallback of WifiManager.java, there is a possible way to determine whether an app is i…
-
Low 3.3
In registerBroadcastReceiver of RcsService.java, there is a possible way to change preferred TTY mode due to a missing …
-
Low 3.3
In createDialog of WifiScanModeActivity.java, there is a possible way for a Guest user to enable location-sensitive set…
-
Low 3.3
In launchConfigNewNetworkFragment of NetworkProviderSettings.java, there is a possible way for the guest user to add a …
-
Low 3.3
In registerReceivers of DeviceCapabilityListener.java, there is a possible way to change preferred TTY mode due to a pe…
-
Low 3.3
In revokeOwnPermissionsOnKill of PermissionManager.java, there is a possible way to determine whether an app is install…
-
Low 3.3
In various functions of ap_input_processor.c, there is a possible way to record audio during a phone call due to a logi…
-
Low 2.4
In multiple locations of WifiDialogActivity.java, there is a possible limited lockscreen bypass due to a logic error in…
-
Low 2.3
In sOpAllowSystemRestrictionBypass of AppOpsManager.java, there is a possible leak of location information due to a mis…
-
Low 2.3
In multiple locations, there is a possible display crash loop due to improper input validation. This could lead to loca…
-
Unscored —CVE-2021-39617 Rejected
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigat…
-
Unscored —
In Settings, there is a possible way to misrepresent which app wants to add a wifi network due to improper input valida…
-
Unscored —CVE-2021-39795 Rejected
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: Pulled from…
-
Unscored —
A flaw was found in unrestricted eBPF usage by the BPF_BTF_LOAD, leading to a possible out-of-bounds memory write in th…
-
Unscored —
The root cause of this vulnerability is that the ioctl$DRM_IOCTL_MODE_DESTROY_DUMB can decrease refcount of *drm_vgem_g…
-
Unscored —
In deletePackageX of DeletePackageHelper.java, there is a possible way for a Guest user to reset pre-loaded application…
-
Unscored —
In multiple functions of AvatarPhotoController.java, there is a possible access to content owned by system content prov…
-
Unscored —CVE-2022-20444 Rejected
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigat…
-
Unscored —
In Telecom, there is a possible way to determine whether an app is installed, without query permissions, due to side ch…
-
Unscored —
Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation, aka Spectre-B…
-
Unscored —
ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.
-
Unscored —CVE-2022-30594 Public exploit
The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers to bypass in…
-
Unscored —
rpmsg_virtio_add_ctrl_dev in drivers/rpmsg/virtio_rpmsg_bus.c in the Linux kernel before 5.18.4 has a double free.
-
Unscored —
rpmsg_probe in drivers/rpmsg/virtio_rpmsg_bus.c in the Linux kernel before 5.18.4 has a double free.
Revision history
-
#2
Neue Updates von SUSE aufgenommen
-
#1
Initiale Fassung
References
-
SUSE Security Update SUSE-SU-2023:1801-1 vom 2023-04-10
https://lists.suse.com/pipermail/sle-security-updates/2023-April/014437.html
-
Android Security BulletinDecember 2022 vom 2022-12-05
https://source.android.com/docs/security/bulletin/2022-12-01
-
Pixel Update BulletinDecember2022 vom 2022-12-05
https://source.android.com/docs/security/bulletin/pixel/2022-12-01