Summary
Ein Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, einen Denial-of-Service-Zustand zu erzeugen, beliebigen Code auszuführen oder vertrauliche Informationen preiszugeben.
Product
Das Android Betriebssystem ist eine quelloffene Plattform für mobile Geräte. Die Basis bildet der Linux-Kernel.
Vulnerabilities 43
-
High 7.3
In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to pre…
KEV Nov 7, 2024 -
Medium 5.5CVE-2024-50302 Exploited
HID: core: zero-initialize the report buffer
In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by all kinds of drivers in various ways, let's zero-initialize it during allocation to make sure that it can't be …
KEV Mar 4, 2025 -
Critical 9.8
In process_service_attr_rsp of sdp_discovery.cc, there is a possible way to execute arbitrary code due to a use after f…
-
Critical 9.8
In process_service_search_attr_req of sdp_server.cc, there is a possible way to execute arbitrary code due to a use aft…
-
Critical 9.8
In sdp_snd_service_search_req of sdp_discovery.cc, there is a possible way to execute arbitrary code due to a use after…
-
Critical 9.8
In rfc_check_send_cmd of rfc_utils.cc, there is a possible way to execute arbitrary code due to a use after free. This …
-
High 8.8
In main of main.cpp, there is a possible way to bypass SELinux due to a logic error in the code. This could lead to loc…
-
High 8.8
In multiple locations, there is a possible out of bounds write due to a use after free. This could lead to remote code …
-
High 8.8
In process_service_attr_rsp of sdp_discovery.cc, there is a possible use after free due to a logic error in the code. T…
-
High 8.8
In multiple functions of sdp_server.cc, there is a possible use after free due to a logic error in the code. This could…
-
High 8.4
In avct_lcb_msg_ind of avct_lcb_act.cc, there is a possible way to execute arbitrary code due to a use after free. This…
-
High 8.4
In multiple locations, there is a possible way to execute arbitrary code due to a use after free. This could lead to lo…
-
High 8.4
In bnepu_check_send_packet of bnep_utils.cc, there is a possible way to achieve code execution due to a use after free.…
-
High 8.4
In rfc_send_buf_uih of rfc_ts_frames.cc, there is a possible way to execute arbitrary code due to a use after free. Thi…
-
High 8.4
In multiple locations, there is a possible way to execute arbitrary code due to a use after free. This could lead to lo…
-
High 8.2
Buffer Over-read in WLAN HOST
Information disclosure while parsing the OCI IE with invalid length.
-
High 8.0CVE-2023-21125 Public exploit
In btif_hh_hsdata_rpt_copy_cb of bta_hh.cc, there is a possible way to corrupt memory due to a use after free. This cou…
-
High 7.9
Permissions, Privileges, and Access Controls in Video Analytics and Processing
Information disclosure may occur due to improper permission and access controls to Video Analytics engine.
-
High 7.8
dma-buf: heaps: Fix off-by-one in CMA heap fault handler
In the Linux kernel, the following vulnerability has been resolved: dma-buf: heaps: Fix off-by-one in CMA heap fault handler Until VM_DONTEXPAND was added in commit 1c1914d6e8c6 ("dma-buf: heaps: Don't track CMA dma-buf pages under RssFile") it was possible t…
-
High 7.8
Improper Validation of Array Index in Camera
Memory corruption may occur during the synchronization of the camera`s frame processing pipeline.
-
High 7.8
Improper Validation of Array Index in Audio
Memory corruption may occur while validating ports and channels in Audio driver.
-
High 7.8
NULL Pointer Dereference in Display
Memory corruption in display driver while detaching a device.
-
High 7.8
In multiple locations, there is a possible way that avdtp and avctp channels could be unencrypted due to a logic error …
-
High 7.8
In multiple locations, there is a possible way to overlay the installation confirmation dialog due to a tapjacking/over…
-
High 7.8
In KeyInstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalati…
-
High 7.5CVE-2024-53027 Public exploit
Buffer Copy Without Checking Size of Input in WLAN Host
Transient DOS may occur while processing the country IE.
-
High 7.5
In dng_lossless_decoder::HuffDecode of dng_lossless_jpeg.cpp, there is a possible way to cause a crash due to uninitial…
-
High 7.5
In handleBondStateChanged of AdapterService.java, there is a possible unapproved data access due to a missing permissio…
-
Medium 6.8
In multiple locations, there is a possible way to request access to directories that should be hidden due to improper i…
-
Medium 6.5
In handleBondStateChanged of AdapterService.java, there is a possible permission bypass due to misleading or insufficie…
-
Medium 6.5
In Modem, there is a possible memory corruption due to incorrect error handling. This could lead to remote denial of se…
-
Medium 6.2
In onResult of AccountManagerService.java, there is a possible way to overwrite auth token due to a missing permission …
-
Medium 5.5
Improper Authorization in SPS-HLOS
Information disclosure while deriving keys for a session for any Widevine use case.
-
Medium 5.5
In generateFileInfo of BluetoothOppSendFileInfo.java, there is a possible cross user media disclosure due to a confused…
-
Medium 5.5
In multiple locations, there is a possible crash loop due to resource exhaustion. This could lead to local denial of se…
-
Medium 5.5
Integer Overflow or Wraparound in BT Controller
Transient DOS can occur while processing UCI command.
-
Medium 5.5
In multiple functions of StatusHint.java and TelecomServiceImpl.java, there is a possible way to reveal images across u…
-
Medium 5.5
In hidd_check_config_done of hidd_conn.cc, there is a possible way to execute arbitrary code due to a use after free. T…
-
Medium 5.1CVE-2025-0087 Public exploit
In onCreate of UninstallerActivity.java, there is a possible way to uninstall a different user's app due to a missing p…
-
Medium 5.0
In multiple locations, there is a possible cross-user image read due to a missing permission check. This could lead to …
-
Medium 4.0
In multiple locations, there is a possible way to access content across user profiles due to URI double encoding. This …
-
Medium 4.0
In multiple functions of hyp-main.c, there is a possible privilege escalation due to a logic error in the code. This co…
-
Medium 4.0CVE-2025-26417 Public exploit
In checkWhetherCallingAppHasAccess of DownloadProvider.java, there is a possible bypass of user consent when opening fi…
Revision history
-
#5
Referenz(en) aufgenommen: EUVD-2025-26864
-
#4
Referenz(en) aufgenommen: EUVD-2024-54955
-
#3
Referenz(en) aufgenommen: EUVD-2023-25293
-
#2
Referenz(en) aufgenommen: EUVD-2025-25843, EUVD-2025-25842, EUVD-2025-25841, EUVD-2025-25840, EUVD-2025-25845, EUVD-2025-25852, EUVD-2025-25855, EUVD-2025-25857, EUVD-2025-25858, EUVD-2025-25860, EUVD-2025-25851, EUVD-2025-25839, EUVD-2025-25846, EUVD-2025-25847, EUVD-2025-25848, EUVD-2025-25849, EUVD-2025-25850, EUVD-2025-25854, EUVD-2025-25859, EUVD-2025-25861, EUVD-2025-25862, EUVD-2024-54915, EUVD-2025-25856, EUVD-2025-25853
-
#1
Initiale Fassung
References
-
Android Security Bulletin vom 2025-03-03
https://source.android.com/docs/security/bulletin/2025-03-01