Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen, seine Privilegien zu erhöhen, einen Denial of Service Zustand herbeizuführen oder Informationen offenzulegen.
Product
Das Android Betriebssystem von Google ist eine quelloffene Plattform für mobile Geräte. Die Basis bildet der Linux-Kernel.
Vulnerabilities 129
-
High 7.8
In getView of AddAppNetworksFragment.java, there is a possible way to mislead the user about network add requests due t…
-
Medium 5.3
A security flaw was found in the Linux kernel in a way that the cleancache subsystem clears an inode after the final fi…
-
Medium 4.4
In fdt_path_offset_namelen of fdt_ro.c, there is a possible out of bounds read due to an incorrect bounds check. This c…
-
Unscored —
In the Linux kernel before 5.2.9, there is an info-leak bug that can be caused by a malicious USB device in the drivers…
-
Unscored —
An issue was discovered in the Linux kernel before 5.4.7. The prb_calc_retire_blk_tmo() function in net/packet/af_packe…
-
Unscored —
In the Broadcom Nexus firmware, there is an insecure default password. This could lead to local escalation of privilege…
-
Unscored —
In the Broadcom Nexus firmware, there is an insecure default password. This could lead to local information disclosure …
-
Unscored —
In addWindow of WindowManagerService.java, there is a possible window overlay attack due to an insecure default value. …
-
Unscored —
In onHandleIntent of TraceService.java, there is a possible bypass of developer settings requirements for capturing sys…
-
Unscored —
In writeBurstBufferBytes of SPDIFEncoder.cpp, there is a possible out of bounds read due to an incorrect bounds check. …
-
Unscored —
In nci_proc_ee_management_rsp of nci_hrcv.cc, there is a possible out of bounds read due to a missing bounds check. Thi…
-
Unscored —
In bindWallpaperComponentLocked of WallpaperManagerService.java, there is a possible permission bypass due to an unsafe…
-
Unscored —
In queryInternal of CallLogProvider.java, there is a possible permission bypass due to improper input validation. This …
-
Unscored —
In createVirtualDisplay of DisplayManagerService.java, there is a possible way to create a trusted virtual display due …
-
Unscored —
In audit_free_lsm_field of auditfilter.c, there is a possible bad kfree due to a logic error in audit_data_to_entry. Th…
-
Unscored —
There is a possible out of bounds write due to a missing bounds check.Product: AndroidVersions: Android SoCAndroid ID: …
-
Unscored —
There is a possible out of bounds write due to a missing bounds check.Product: AndroidVersions: Android SoCAndroid ID: …
-
Unscored —
There is a possible out of bounds write due to a missing bounds check.Product: AndroidVersions: Android SoCAndroid ID: …
-
Unscored —CVE-2020-0458 Public exploit
In SPDIFEncoder::writeBurstBufferBytes and related methods of SPDIFEncoder.cpp, there is a possible out of bounds write…
-
Unscored —
In sendConfiguredNetworkChangedBroadcast of WifiConfigManager.java, there is a possible leak of sensitive WiFi configur…
-
Unscored —
In createNameCredentialDialog of CertInstaller.java, there exists the possibility of improperly installed certificates …
-
Unscored —CVE-2020-0463 Public exploit
In sdp_server_handle_client_req of sdp_server.cc, there is a possible out of bounds read due to a missing bounds check.…
-
Unscored —
In resolv_cache_lookup of res_cache.cpp, there is a possible side channel information disclosure. This could lead to lo…
-
Unscored —
In various methods of hid-multitouch.c, there is a possible out of bounds write due to a missing bounds check. This cou…
-
Unscored —
In do_epoll_ctl and ep_loop_check_proc of eventpoll.c, there is a possible use after free due to a logic error. This co…
-
Unscored —
In onUserStopped of Vpn.java, there is a possible resetting of user preferences due to a logic issue. This could lead t…
-
Unscored —
In listen() and related functions of TelephonyRegistry.java, there is a possible permissions bypass of location permiss…
-
Unscored —
In addEscrowToken of LockSettingsService.java, there is a possible loss of the synthetic password due to logic error. T…
-
Unscored —
In extend_frame_highbd of restoration.c, there is a possible out of bounds write due to a heap buffer overflow. This co…
-
Unscored —
In updateIncomingFileConfirmNotification of BluetoothOppNotification.java, there is a possible permissions bypass. This…
-
Unscored —
In HalCamera::requestNewFrame of HalCamera.cpp, there is a possible use-after-free due to a race condition. This could …
-
Unscored —
In createInputConsumer of WindowManagerService.java, there is a possible way to block and intercept input events due to…
-
Unscored —
In onNotificationRemoved of Assistant.java, there is a possible leak of sensitive information to logs. This could lead …
-
Unscored —
In sendLinkConfigurationChangedBroadcast of ClientModeImpl.java, there is a possible information disclosure due to a mi…
-
Unscored —
In extend_frame_lowbd of restoration.c, there is a possible out of bounds write due to a missing bounds check. This cou…
-
Unscored —
In callUnchecked of DocumentsProvider.java, there is a possible permissions bypass. This could lead to local escalation…
-
Unscored —
In callUnchecked of DocumentsProvider.java, there is a possible permissions bypass due to a missing permission check. T…
-
Unscored —
In AndroidManifest.xml, there is a possible permissions bypass. This could lead to local escalation of privilege allowi…
-
Unscored —
In command of IncidentService.cpp, there is a possible out of bounds read due to an incorrect bounds check. This could …
-
Unscored —
In DrmManagerService::~DrmManagerService() of DrmManagerService.cpp, there is a possible memory corruption due to a use…
-
Unscored —
In destroyResources of ComposerClient.h, there is possible memory corruption due to a use after free. This could lead t…
-
Unscored —
In areFunctionsSupported of UsbBackend.java, there is a possible access to tethering from a guest account due to a miss…
-
Unscored —
In openAssetFileListener of ContactsProvider2.java, there is a possible permission bypass due to an insecure default va…
-
Unscored —CVE-2020-0487 Rejected
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
-
Unscored —
In ihevc_inter_pred_chroma_copy_ssse3 of ihevc_inter_pred_filters_ssse3_intr.c, there is a possible information disclos…
-
Unscored —
In Parse_data of eas_mdls.c, there is a possible out of bounds write due to a missing bounds check. This could lead to …
-
Unscored —
In floor1_info_unpack of floor1.c, there is a possible out of bounds read due to a missing bounds check. This could lea…
-
Unscored —
In readBlock of MatroskaExtractor.cpp, there is a possible denial of service due to resource exhaustion. This could lea…
-
Unscored —
In BitstreamFillCache of bitstream.cpp, there is a possible out of bounds read due to a heap buffer overflow. This coul…
-
Unscored —
In CPDF_SampledFunc::v_Call of cpdf_sampledfunc.cpp, there is a possible out of bounds read due to improper input valid…
-
Unscored —
In ih264d_parse_ave of ih264d_sei.c, there is a possible out of bounds read due to a heap buffer overflow. This could l…
-
Unscored —
In decode_Huffman of JBig2_SddProc.cpp, there is a possible out of bounds write due to an integer overflow. This could …
-
Unscored —
In CPDF_RenderStatus::LoadSMask of cpdf_renderstatus.cpp, there is a possible memory corruption due to a use-after free…
-
Unscored —
In canUseBiometric of BiometricServiceBase, there is a missing permission check. This could lead to local information d…
-
Unscored —
In decode_packed_entry_number of codebook.c, there is a possible out of bounds read due to a heap buffer overflow. This…
-
Unscored —
In FLAC__bitreader_read_rice_signed_block of bitreader.c, there is a possible out of bounds read due to a heap buffer o…
-
Unscored —
In startInputUncheckedLocked of InputMethodManager.java, there is a possible permission bypass due to an unsafe Pending…
-
Unscored —
Buffer over-read can happen when the buffer length received from response handlers is more than the size of the payload…
-
Unscored —
Buffer Over-read in audio driver while using malloc management function due to not returning NULL for zero sized memory…
-
Unscored —
Integer multiplication overflow resulting in lower buffer size allocation than expected causes memory access out of bou…
-
Unscored —
Uninitialized pointers accessed during music play back with incorrect bit stream due to an uninitialized heap memory re…
-
Unscored —
Out of bound memory access while processing frames due to lack of check of invalid frames received in Snapdragon Auto, …
-
Unscored —
Out of bound memory access during music playback with ALAC modified content due to improper validation in Snapdragon Au…
-
Unscored —
Out of bound memory access during music playback with modified content due to copying data without checking destination…
-
Unscored —
Buffer over-read while UE process invalid DL ROHC packet for decompression due to lack of check of size of compresses p…
-
Unscored —
Divide by zero issue can happen while updating delta extension header due to improper validation of master SN and exten…
-
Unscored —
Out of bound write while copying data using IOCTL due to lack of check of array index received from user in Snapdragon …
-
Unscored —
Use after free issue in HIDL while using callback to post event in Rx thread when internal mutex is not acquired and me…
-
Unscored —
Out of bound access due to usage of an out-of-range pointer offset in the camera driver. in Snapdragon Auto, Snapdragon…
-
Unscored —
Out of bound memory access in camera driver due to improper validation on data coming from UMD which is used for offset…
-
Unscored —
Race condition occurs while calling user space ioctl from two different threads can results to use after free issue in …
-
Unscored —
Race condition in HAL layer while processing callback objects received from HIDL due to lack of synchronization between…
-
Unscored —
Memory corruption while calculating L2CAP packet length in reassembly logic when remote sends more data than expected i…
-
Unscored —CVE-2020-11179 Public exploit
Arbitrary read and write to kernel addresses by temporarily overwriting ring buffer pointer and creating a race conditi…
-
Unscored —
A process can potentially cause a buffer overflow in the display service allowing privilege escalation by executing cod…
-
Unscored —
Out of bound issue in WLAN driver while processing vdev responses from firmware due to lack of validation of data recei…
-
Unscored —
Possible integer overflow can occur when stream info update is called when total number of streams detected are zero wh…
-
Unscored —
Buffer over-read while parsing RPS due to lack of check of input validation on values received from user side. in Snapd…
-
Unscored —
Out of bounds reads while parsing NAN beacons attributes and OUIs due to improper length of field check in Snapdragon A…
-
Unscored —
Out of bound reads might occur in while processing Service descriptor due to improper validation of length of fields in…
-
Unscored —
Buffer over-read while processing NDL attribute if attribute length is larger than expected and then FW is treating it …
-
Unscored —
An out of bounds read can happen when processing VSA attribute due to improper minimum required length check in Snapdra…
-
Unscored —
Buffer over read can happen in video driver when playing clip with atomsize having value UINT32_MAX in Snapdragon Auto,…
-
Unscored —
A possible double free or invalid memory access in audio driver while reading Speaker Protection parameters in Snapdrag…
-
Unscored —
Out of bound access in WLAN driver due to lack of validation of array length before copying into array in Snapdragon Au…
-
Unscored —
gadget_dev_desc_UDC_store in drivers/usb/gadget/configfs.c in the Linux kernel 3.16 through 5.6.13 relies on kstrdup wi…
-
Unscored —CVE-2020-15802 Public exploit
Devices supporting Bluetooth before 5.1 may allow man-in-the-middle attacks, aka BLURtooth. Cross Transport Key Derivat…
-
Unscored —
The Linux kernel 4.9.x before 4.9.233, 4.14.x before 4.14.194, and 4.19.x before 4.19.140 has a use-after-free because …
-
Unscored —
In avrc_ctrl_pars_vendor_cmd of avrc_pars_tg.cc, there is a possible out of bounds read due to a missing bounds check. …
-
Unscored —
In setErrorPlaybackState of BluetoothMediaBrowserService.java, there is a possible permission bypass due to an unsafe P…
-
Unscored —
In smp_br_state_machine_event of smp_br_main.cc, there is a possible out of bounds read due to a missing bounds check. …
-
Unscored —
In EapFailureNotifier.java and SimRequiredNotifier.java, there is a possible permission bypass due to an unsafe Pending…
-
Unscored —
During boot, the device unlock interface behaves differently depending on if a fingerprint registered to the device is …
-
Unscored —
In nfc_ncif_proc_get_routing of nfc_ncif.cc, there is a possible out of bounds read due to a missing bounds check. This…
-
Unscored —
In filter_incoming_event of hci_layer.cc, there is a possible out of bounds read due to a missing bounds check. This co…
-
Unscored —
In TextView of TextView.java, there is a possible app hang due to improper input validation. This could lead to remote …
-
Unscored —
In onCreate of HandleApiCalls.java, there is a possible permission bypass due to a confused deputy. This could lead to …
-
Unscored —
In nfc_data_event of nfc_ncif.cc, there is a possible out of bounds read due to a missing bounds check. This could lead…
-
Unscored —
In getRadioAccessFamily of PhoneInterfaceManager.java, there is a possible read of privileged data due to a missing per…
-
Unscored —
In nfc_ncif_proc_get_routing of nfc_ncif.cc, there is a possible out of bounds read due to a missing bounds check. This…
-
Unscored —
In createSimSelectNotification of SimSelectNotification.java, there is a possible permission bypass due to an unsafe Pe…
-
Unscored —
In priorLinearAllocation of C2AllocatorIon.cpp, there is a possible use-after-free due to improper locking. This could …
-
Unscored —
In phNxpNciHal_send_ext_cmd of phNxpNciHal_ext.cc, there is a possible out of bounds write due to a missing bounds chec…
-
Unscored —
In phNxpNciHal_core_initialized of phNxpNciHal.cc, there is a possible out of bounds read due to a missing bounds check…
-
Unscored —
In process of C2SoftVorbisDec.cpp, there is a possible resource exhaustion due to a memory leak. This could lead to rem…
-
Unscored —
In postNotification of ServiceRecord.java, there is a possible permission bypass due to an unsafe PendingIntent. This c…
-
Unscored —
In phNxpNciHal_core_initialized of phNxpNciHal.cc, there is a possible out of bounds read due to a missing bounds check…
-
Unscored —
In showProvisioningNotification of ConnectivityService.java, there is an unsafe PendingIntent. This could lead to local…
-
Unscored —
In nfc_enabled of nfc_main.cc, there is a possible out of bounds read due to an incorrect increment. This could lead to…
-
Unscored —
In restartWrite of Parcel.cpp, there is a possible memory corruption due to a use after free. This could lead to local …
-
Unscored —
In CE_SendRawFrame of ce_main.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lea…
-
Unscored —
In nfc_ncif_proc_ee_action of nfc_ncif.cc, there is a possible out of bounds read due to a missing bounds check. This c…
-
Unscored —
In ce_t4t_update_binary of ce_t4t.cc, there is a possible out of bounds read due to a missing bounds check. This could …
-
Unscored —
In RW_SendRawFrame of rw_main.cc, there is a possible out of bounds write due to a missing bounds check. This could lea…
-
Unscored —
In rw_t3t_send_raw_frame of rw_t3t.cc, there is a possible out of bounds write due to a missing bounds check. This coul…
-
Unscored —
In rw_i93_send_cmd_write_multi_blocks of rw_i93.cc, there is a possible out of bounds write due to a heap buffer overfl…
-
Unscored —
In NFA_RwI93WriteMultipleBlocks of nfa_rw_api.cc, there is a possible out of bounds write due to an integer overflow. T…
-
Unscored —
In getLockTaskLaunchMode of ActivityRecord.java, there is a possible way for any app to start in Lock Task Mode due to …
-
Unscored —
In broadcastWifiCredentialChanged of ClientModeImpl.java, there is a possible location permission bypass due to a missi…
-
Unscored —
In onFactoryReset of BluetoothManagerService.java, there is a missing permission check. This could lead to local escala…
-
Unscored —
In isSubmittable and showWarningMessagesIfAppropriate of WifiConfigController.java and WifiConfigController2.java, ther…
-
Unscored —
In SELinux policies of mls, there is a missing permission check. This could lead to local information disclosure of pac…
-
Unscored —
In getGpuStatsGlobalInfo and getGpuStatsAppInfo of GpuService.cpp, there is a possible permission bypass due to a missi…
-
Unscored —
In xfrm6_tunnel_free_spi of net/ipv6/xfrm6_tunnel.c, there is a possible use after free due to improper locking. This c…
-
Unscored —
In the l2tp subsystem, there is a possible use after free due to a race condition. This could lead to local escalation …
-
Unscored —
Product: AndroidVersions: Android kernelAndroid ID: A-127973231References: Upstream kernel
-
Unscored —
Pointer variable which is freed is not cleared can result in memory corruption and leads to denial of service in Snapdr…
-
Unscored —
Possible memory out of bound issue during music playback when an incorrect bit stream content is copied into array with…
-
Unscored —
Possible out of bound memory access in audio due to integer underflow while processing modified contents in Snapdragon …
Revision history
-
#18
Neue Updates von SUSE und IBM aufgenommen
-
#17
CVE ergänzt
-
#16
Neue Updates von Red Hat aufgenommen
-
#15
Neue Updates von AVAYA aufgenommen
-
#14
Neue Updates von Red Hat aufgenommen
-
#13
Neue Updates von Red Hat aufgenommen
-
#12
Neue Updates von Red Hat aufgenommen
-
#11
Neue Updates von Red Hat aufgenommen
-
#10
Neue Updates von AVAYA aufgenommen
-
#9
Neue Updates von Oracle Linux aufgenommen
-
#8
Neue Updates von Oracle Linux aufgenommen
-
#7
Neue Updates von Red Hat aufgenommen
-
#6
Neue Updates von Red Hat aufgenommen
-
#5
Neue Updates von Red Hat aufgenommen
-
#4
Neue Updates von SUSE aufgenommen
-
#3
Neue Updates von SUSE aufgenommen
-
#2
Neue Updates von BlackBerry aufgenommen
-
#1
Initiale Fassung
References
-
IBM Security Bulletin 6999317 vom 2023-05-30
https://www.ibm.com/support/pages/node/6999317
-
SUSE Security Update SUSE-SU-2023:2314-1 vom 2023-05-30
https://lists.suse.com/pipermail/sle-security-updates/2023-May/015022.html
-
AVAYA Security Advisory ASA-2021-026 vom 2021-05-07
https://downloads.avaya.com/css/P8/documents/101075693
-
Red Hat Security Advisory RHSA-2021:1093 vom 2021-04-06
https://access.redhat.com/errata/RHSA-2021:1093
-
Oracle Linux Security Advisory ELSA-2021-1093 vom 2021-04-07
http://linux.oracle.com/errata/ELSA-2021-1093.html
-
Oracle Linux Security Advisory ELSA-2021-9164 vom 2021-04-09
http://linux.oracle.com/errata/ELSA-2021-9164.html
-
Red Hat Security Advisory RHSA-2021:2099 vom 2021-05-25
https://access.redhat.com/errata/RHSA-2021:2099
-
Android Security Bulletin Dezember 2020 vom 2020-12-15
https://source.android.com/security/bulletin/2020-12-01
-
Pixel Update Bulletin - Dezember 2020
https://source.android.com/security/bulletin/pixel/2020-12-01
-
BlackBerry Powered by Android Security Bulletin - December 2020
http://support.blackberry.com/kb/articleDetail?language=en_US&articleNumber=000072551
-
SUSE Security Update SUSE-SU-2020:3933-1 vom 2020-12-24
https://lists.suse.com/pipermail/sle-security-updates/2020-December/008120.html
-
Red Hat Security Advisory RHSA-2021:2106 vom 2021-05-25
https://access.redhat.com/errata/RHSA-2021:2106
-
SUSE Security Update SUSE-SU-2021:0452-1 vom 2021-02-12
https://lists.suse.com/pipermail/sle-security-updates/2021-February/008323.html
-
Red Hat Security Advisory RHSA-2021:0686 vom 2021-03-02
https://access.redhat.com/errata/RHSA-2021:0686
-
Red Hat Security Advisory RHSA-2021:0689 vom 2021-03-02
https://access.redhat.com/errata/RHSA-2021:0689
-
Red Hat Security Advisory RHSA-2021:0763 vom 2021-03-09
https://access.redhat.com/errata/RHSA-2021:0763
-
Red Hat Security Advisory RHSA-2021:0774 vom 2021-03-09
https://access.redhat.com/errata/RHSA-2021:0774
-
Red Hat Security Advisory RHSA-2021:0765 vom 2021-03-09
https://access.redhat.com/errata/RHSA-2021:0765
-
Red Hat Security Advisory RHSA-2022:0529 vom 2022-02-15
https://access.redhat.com/errata/RHSA-2022:0529
-
Red Hat Security Advisory RHSA-2022:0533 vom 2022-02-15
https://access.redhat.com/errata/RHSA-2022:0533
-
Red Hat Security Advisory RHSA-2022:0531 vom 2022-02-15
https://access.redhat.com/errata/RHSA-2022:0531
-
Red Hat Security Advisory RHSA-2022:0592 vom 2022-02-22
https://access.redhat.com/errata/RHSA-2022:0592
-
Red Hat Security Advisory RHSA-2022:0622 vom 2022-02-22
https://access.redhat.com/errata/RHSA-2022:0622
-
AVAYA Security Advisory ASA-2022-026 vom 2022-02-25
https://downloads.avaya.com/css/P8/documents/101080640
-
Red Hat Security Advisory RHSA-2022:0712 vom 2022-03-01
https://access.redhat.com/errata/RHSA-2022:0712
-
Red Hat Security Advisory RHSA-2022:0718 vom 2022-03-01
https://access.redhat.com/errata/RHSA-2022:0718