Android Security Bulletin — November 2018

Monday, 5 November 2018

Vulnerabilities: 31
Critical: 0
High: 0
Zero-days: 0
Public exploit: 2

Exploited 0

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

None of this release's vulnerabilities is known to be exploited so far.

Public exploit code 2

Not critical and not yet seen exploited, but exploit or proof-of-concept code is public.

Unscored
CVE-2018-9445 Public exploit In readMetadata of Utils.cpp, there is a possible path traversal bug due to a confused deputy. This could lead to local escalation of privilege when mounting a…
Unscored
CVE-2018-9488 Public exploit In the SELinux permissions of crash_dump.te, there is a permissions bypass due to a missing restriction. This could lead to a local escalation of privilege, wi…

All vulnerabilities 31

Unscored31 Show

Unscored
CVE-2018-9445 Public exploit In readMetadata of Utils.cpp, there is a possible path traversal bug due to a confused deputy. This could lead to local escalation of privilege when mounting a…
Unscored
CVE-2018-9488 Public exploit In the SELinux permissions of crash_dump.te, there is a permissions bypass due to a missing restriction. This could lead to a local escalation of privilege, wi…
Unscored
CVE-2018-9355 In bta_dm_sdp_result of bta_dm_act.cc, there is a possible out of bounds stack write due to a missing bounds check. This could lead to remote code execution wi…
EPSS 3%
Unscored
CVE-2018-9356 In bnep_data_ind of bnep_main.c, there is a possible remote code execution due to a double free. This could lead to remote code execution with no additional ex…
EPSS 3.2%
Unscored
CVE-2018-9357 In BNEP_Write of bnep_api.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with U…
Unscored
CVE-2018-9358 In gatts_process_attribute_req of gatt_sc.cc, there is a possible read of uninitialized data due to a missing bounds check. This could lead to remote informati…
EPSS 1.7%
Unscored
CVE-2018-9359 In process_l2cap_cmd of l2c_main.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure wit…
EPSS 1.7%
Unscored
CVE-2018-9360 In process_l2cap_cmd of l2c_main.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure wit…
EPSS 1.7%
Unscored
CVE-2018-9361 In process_l2cap_cmd of l2c_main.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure wit…
EPSS 1.7%
Unscored
CVE-2018-9362 In processMessagePart of InboundSmsHandler.java, there is a possible remote denial of service due to improper input validation. This could lead to remote denia…
EPSS 1.6%
Unscored
CVE-2018-9363 In the hidp_process_report in bluetooth, there is an integer overflow. This could lead to an out of bounds write with no additional execution privileges needed…
Unscored
CVE-2018-9385 In driver_override_store of bus.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege w…
Unscored
CVE-2018-9415 In driver_override_store and driver_override_show of bus.c, there is a possible double free due to improper locking. This could lead to local escalation of pri…
Unscored
CVE-2018-9422 In get_futex_key of futex.c, there is a use-after-free due to improper locking. This could lead to local escalation of privilege with no additional privileges …
Unscored
CVE-2018-9427 In CopyToOMX of OMXNodeInstance.cpp there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to remote arbitrary code executio…
EPSS 1.8%
Unscored
CVE-2018-9436 In bnep_data_ind of bnep_main.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with n…
EPSS 1.7%
Unscored
CVE-2018-9437 In getstring of ID3.cpp there is a possible out-of-bounds read due to a missing bounds check. This could lead to remote denial of service with no additional ex…
Unscored
CVE-2018-9438 When a device connects only over WiFi VPN, the device may not receive security updates due to some incorrect checks. This could lead to a local denial of servi…
Unscored
CVE-2018-9444 In ih264d_video_decode of ih264d_api.c there is a possible resource exhaustion due to an infinite loop. This could lead to remote temporary device denial of se…
Unscored
CVE-2018-9446 In smp_br_state_machine_event of smp_br_main.cc, there is a possible out of bounds write due to memory corruption. This could lead to remote code execution wit…
EPSS 2.1%
Unscored
CVE-2018-9448 In avct_bcb_msg_ind of avct_bcb_act.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure …
EPSS 1.7%
Unscored
CVE-2018-9450 In avrc_proc_vendor_command of avrc_api.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution wit…
EPSS 2.7%
Unscored
CVE-2018-9451 In DynamicRefTable::load of ResourceTypes.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information discl…
Unscored
CVE-2018-9453 In avdt_msg_prs_cfg of avdt_msg.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with …
Unscored
CVE-2018-9454 In bnep_data_ind of bnep_main.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no…
Unscored
CVE-2018-9455 In sdpu_extract_attr_seq of sdp_utils.cc, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote denial of service …
EPSS 1.6%
Unscored
CVE-2018-9458 In computeFocusedWindow of RootWindowContainer.java, and related functions, there is possible interception of keypresses due to focus being on the wrong window…
Unscored
CVE-2018-9459 In Attachment of Attachment.java and getFilePath of EmlAttachmentProvider.java, there is a possible Elevation of Privilege due to a path traversal error. This …
EPSS 1.7%
Unscored
CVE-2018-9465 In task_get_unused_fd_flags of binder.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with n…
Unscored
CVE-2018-9489 When wifi is switched, function sendNetworkStateChangeBroadcast of WifiStateMachine.java broadcasts an intent including detailed wifi network information. This…
Unscored
CVE-2018-9516 In hid_debug_events_read of drivers/hid/hid-debug.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation…