Android.

Android: In llcp_util_parse_connect of llcp_util.cc…

• Android

In binder_thread_read of binder.c, there is a possible use-after-free due to improper locking.

• Android

In em28xx_unregister_dvb of em28xx-dvb.c, there is a possible use after free issue.

• Android

Android: In ServiceManager::add function in the hardware service manager…

• Android

In addLinks of Linkify.java, there is a possible phishing vector due to an unusual root cause.

• Android

Android: In rw_t3t_act_handle_fmt_rsp and rw_t3t_act_handle_sro_rsp of rw_t3t.cc…

• Android

Android: In rw_t3t_act_handle_ndef_detect_rsp of rw_t3t.cc…

• Android

Android: In llcp_dlc_proc_rr_rnr_pdu of llcp_dlc.cc…

• Android

Android: In ce_t4t_data_cback of ce_t4t.cc, there is a possible out-of-bound read due to a missing…

• Android

Android: In llcp_util_parse_link_params of llcp_util.cc…

• Android

Android: In llcp_util_parse_cc of llcp_util.cc…

• Android

Android: In resetPasswordInternal of DevicePolicyManagerService.java…

• Android

Android: In rw_t2t_handle_tlv_detect_rsp of rw_t2t_ndef.cc…

• Android

Android: In NFA_SendRawFrame of nfa_dm_api.cc…

• Android

Android: In rw_t3t_act_handle_check_rsp of rw_t3t.cc…

• Android

Android: In rw_t3t_handle_get_sc_poll_rsp of rw_t3t.cc…

• Android

Android: In rw_t3t_act_handle_sro_rsp of rw_t3t.cc…

• Android

Android: In rw_t3t_act_handle_fmt_rsp of rw_t3t.cc…

• Android

Android: In readNullableNativeHandleNoDup of Parcel.cpp…

• Android

Android: In phNxpNciHal_process_ext_rsp of phNxpNciHal_ext.cc…

• Android

Android: In l2c_lcc_proc_pdu of l2c_fcr.cc, there is a possible out of bounds write due to a…

• Android

In createEffect of AudioFlinger.cpp, there is a possible memory corruption due to a race condition.

• Android

Android: In getReadIndex and getWriteIndex of FifoControllerBase.cpp…

• Android

Android: In serviceDied of HalDeathHandlerHidl.cpp…

• Android

Android: In ihevcd_fmt_conv_420sp_to_420p of ihevcd_fmt_conv.c…

• Android

Android: In ih264d_fmt_conv_420sp_to_420p of ih264d_format_conv.c…

• Android

Android: In onPermissionGrantResult of GrantPermissionsActivity.java…

• Android

Android: In publishKeyEvent, publishMotionEvent and sendUnchainedFinishedSignal of…

• Android

Android: In findAvailSpellCheckerLocked of TextServicesManagerService.java…

• Android

Android: In uvc_parse_standard_control of uvc_driver.c…

• Android

Android: In nfa_rw_store_ndef_rx_buf of nfa_rw_act.cc…

• Android

Android: In areNotificationsEnabledForPackage of NotificationManagerService.java…

• Android

In the Bluetooth Low Energy (BLE) specification, there is a provided example Long Term Key (LTK).

• Android

Android: In HAliasAnalyzer.Query of hydrogen-alias-analysis.h…

• Android

In EffectRelease of EffectBundle.cpp, there is a possible memory corruption due to a double free.

• Android

Android: In callGenIDChangeListeners and related functions of SkPixelRef.cpp…

• Android

Android: In parseMPEGCCData of NuPlayerCCDecoder.cpp…

• Android

Android: In huff_dec_1D of nlc_dec.cpp, there is a possible out of bounds write due to a missing…

• Android

Android: In isSeparateProfileChallengeAllowed of DevicePolicyManagerService.java…

• Android

Android: In GetPermittedAccessibilityServicesForUser of DevicePolicyManagerService.java…

• Android

Android: In isPackageDeviceAdminOnAnyUser of PackageManagerService.java…

• Android

Android: In the seccomp implementation prior to kernel version 4.8…

• Android

Android: In wnm_parse_neighbor_report_elem of wnm_sta.c…

• Android

In VisitPointers of heap.cc, there is a possible out-of-bounds read due to type confusion.

• Android

In heap of spaces.h, there is a possible out of bounds read due to improper input validation.

• Android

Android: In tearDownClientInterface of WificondControl.java…

• Android

Android: In SendMediaUpdate and SendFolderUpdate of avrcp_service.cc…

• Android

In UpdateLoadElement of ic.cc, there is a possible out-of-bounds write due to type confusion.

• Android

Android: In CalculateInstanceSizeForDerivedClass of objects.cc…

• Android

In JSCallTyper of typer.cc, there is an out of bounds write due to an incorrect bounds check.

• Android

Android: In MakeMP>G4VideoCodecSpecificData of APacketSource.cpp…

• Android

Android: In SmsDefaultDialog.onStart of SmsDefaultDialog.java…

• Android

Android: In l2cu_send_peer_config_rej of l2c_utils.cc…

• Android

Android: In the configuration of NFC modules on certain devices…

• Android

Android: In SetScanResponseData of ble_advertiser_hci_interface.cc…

• Android

In btm_proc_smp_cback of tm_ble.cc, there is a possible memory corruption due to a use after free.

• Android

Android: In rw_i93_process_ext_sys_info of rw_i93.cc…

• Android

Android: In rw_i93_sm_detect_ndef of rw_i93.cc…

• Android

Android: In rw_i93_process_sys_info of rw_i93.cc…

• Android

Android: In rw_i93_sm_update_ndef of rw_i93.cc…

• Android