Android Security Bulletin — October 2018

Monday, 1 October 2018

Vulnerabilities: 25
Critical: 0
High: 0
Zero-days: 0
Public exploit: 2

Exploited 0

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

None of this release's vulnerabilities is known to be exploited so far.

Public exploit code 2

Not critical and not yet seen exploited, but exploit or proof-of-concept code is public.

Unscored
CVE-2018-9515 Public exploit In sdcardfs_create and sdcardfs_mkdir of inode.c, there is a possible memory corruption due to improper locking. This could lead to local escalation of privile…
Unscored
CVE-2018-9493 Public exploit In the content provider of the download manager, there is a possible SQL injection due to improper input validation. This could lead to local information discl…

All vulnerabilities 25

Unscored25 Show

Unscored
CVE-2018-9515 Public exploit In sdcardfs_create and sdcardfs_mkdir of inode.c, there is a possible memory corruption due to improper locking. This could lead to local escalation of privile…
Unscored
CVE-2018-9493 Public exploit In the content provider of the download manager, there is a possible SQL injection due to improper input validation. This could lead to local information discl…
Unscored
CVE-2018-9452 In getOffsetForHorizontal of Layout.java, there is a possible application hang due to a slow width calculation. This could lead to remote denial of service if …
Unscored
CVE-2018-9473 In ihevcd_parse_sei_payload of ihevcd_parse_headers.c, there is a possible out-of-bounds write due to an integer overflow. This could lead to remote code execu…
EPSS 1.5%
Unscored
CVE-2018-9476 In avrc_pars_browsing_cmd of avrc_pars_tg.cc, there is a possible use-after-free due to improper locking. This could lead to remote escalation of privilege in …
EPSS 2.5%
Unscored
CVE-2018-9490 In CollectValuesOrEntriesImpl of elements.cc, there is possible remote code execution due to type confusion. This could lead to remote escalation of privilege …
EPSS 1.4%
Unscored
CVE-2018-9491 In AMediaCodecCryptoInfo_new of NdkMediaCodec.cpp, there is a possible out-of-bounds write due to an integer overflow. This could lead to remote code execution…
EPSS 1.5%
Unscored
CVE-2018-9492 In checkGrantUriPermissionLocked of ActivityManagerService.java, there is a possible permissions bypass. This could lead to local escalation of privilege with …
Unscored
CVE-2018-9496 In ixheaacd_real_synth_fft_p3 of ixheaacd_esbr_fft.c there is a possible out of bounds write due to a missing bounds check. This could lead to remote code exec…
EPSS 1.8%
Unscored
CVE-2018-9497 In impeg2_fmt_conv_yuv420p_to_yuv420sp_uv_av8 of impeg2_format_conv.s there is a possible out of bounds write due to missing bounds check. This could lead to r…
EPSS 1.6%
Unscored
CVE-2018-9498 In SkSampler::Fill of SkSampler.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no addit…
EPSS 1.6%
Unscored
CVE-2018-9499 In readVector of iCrypto.cpp, there is a possible invalid read due to uninitialized data. This could lead to local information disclosure from the DRM server w…
Unscored
CVE-2018-9501 In the SetupWizard, there is a possible Factory Reset Protection bypass due to a permissions bypass. This could lead to local escalation of privilege with no a…
Unscored
CVE-2018-9502 In rfc_process_mx_message of rfc_ts_frames.cc, there is a possible out-of-bounds read due to a missing bounds check. This could lead to remote information disc…
EPSS 1.2%
Unscored
CVE-2018-9503 In rfc_process_mx_message of rfc_ts_frames.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disc…
EPSS 2.6%
Unscored
CVE-2018-9504 In sdp_copy_raw_data of sdp_discovery.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution ov…
Unscored
CVE-2018-9505 In mca_ccb_hdl_req of mca_cact.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure over …
Unscored
CVE-2018-9506 In avrc_msg_cback of avrc_api.cc, there is a possible out-of-bound read due to a missing bounds check. This could lead to remote information disclosure over Bl…
Unscored
CVE-2018-9507 In bta_av_proc_meta_cmd of bta_av_act.cc, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote information disclo…
Unscored
CVE-2018-9508 In smp_process_keypress_notification of smp_act.cc, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote informat…
Unscored
CVE-2018-9509 In smp_proc_master_id of smp_act.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure ove…
Unscored
CVE-2018-9510 In smp_proc_enc_info of smp_act.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure over…
Unscored
CVE-2018-9511 In ipSecSetEncapSocketOwner of XfrmController.cpp, there is a possible failure to initialize a security feature due to uninitialized data. This could lead to l…
Unscored
CVE-2018-9513 In copy_process of fork.c, there is possible memory corruption due to a double free. This could lead to local escalation of privilege with no additional execut…
Unscored
CVE-2018-9514 In sdcardfs_open of file.c, there is a possible Use After Free due to an unusual root cause. This could lead to local escalation of privilege with no additiona…