Android.

In (TBD) of (TBD), there is a possible out of bounds read due to memory corruption.

• Android

In ActivityThread.java, there is a possible way to collide the content provider's authorities.

• Android

Android: In getService of IServiceManager.cpp…

• Android

Android: In gatt_process_notification of gatt_cl.cc…

• Android

Use after free in Android

• Android
• Memory corruption

Android: In ParsingPackageImpl of ParsingPackageImpl.java…

• Android

Android: In enforceCrossUserOrProfilePermission of PackageManagerService.java…

• Android

Android: In xhci_vendor_get_ops of xhci.c, there is a possible out of bounds read due to a missing…

• Android

Android: In createOrUpdate of Permission.java…

• Android

Android: In rw_t4t_sm_detect_ndef of rw_t4t.cc…

• Android

In stopVpnProfile of Vpn.java, there is a possible VPN profile reset due to a permissions bypass.

• Android

Android: In onCreate of NfcImportVCardActivity.java…

• Android

Android: In WT_InterpolateNoLoop of eas_wtengine.c…

• Android

Android: In requestChannelBrowsable of TvInputManagerService.java…

• Android

Android: In createFromParcel of OutputConfiguration.java…

• Android

Android: In phNxpNciHal_process_ext_rsp of phNxpNciHal_ext.cc…

• Android

Android: In ion_dma_buf_end_cpu_access and related functions of ion.c…

• Android

Android: In getAlias of BluetoothDevice.java, there is a possible way to create misleading…

• Android

In Android TV , there is a possible silent pairing due to lack of rate limiting in the pairing flow.

• Android

Android: In showNotification of NavigationModeController.java…

• Android

Android: In enqueueNotification of NetworkPolicyManagerService.java…

• Android

Android: In onCreate of CompanionDeviceActivity.java or DeviceChooserActivity.java…

• Android

Android: In onReceive of BluetoothPermissionRequest.java…

• Android

In Browser app, there is a possible information disclosure due to a missing permission check.

• Android

Android: In set_default_passthru_cfg of passthru.c…

• Android

In acc_read of f_accessory.c, there is a possible memory corruption due to a use after free.

• Android

Android: In memzero_explicit of compiler-clang.h…

• Android

In TBD of TBD, there is a possible out of bounds write due to improper locking.

• Android

In ip6_xmit of ip6_output.c, there is a possible out of bounds write due to a use after free.

• Android

In bpf_skb_change_head of filter.c, there is a possible out of bounds read due to a use after free.

• Android

Android: In RevertActiveSessions of apexd.cpp…

• Android

Android: In startListening of PluginManagerImpl.java…

• Android

Android: In RW_SetActivatedTagType of rw_main.cc…

• Android

Android: In sanitizeSbn of NotificationManagerService.java…

• Android

Android: In VectorDrawable::VectorDrawable of VectorDrawable.java…

• Android

Android: In SecondStageMain of init.cpp, there is a possible use after free due to incorrect…

• Android

Android: In getAllSubInfoList of SubscriptionController.java…

• Android

Android: In runDumpHeap of ActivityManagerShellCommand.java…

• Android

In multiple methods of AAudioService, there is a possible use-after-free due to a race condition.

• Android

Android: In loadLabel of PackageItemInfo.java…

• Android

Android: In onCreate of BluetoothPairingDialog…

• Android

In system properties, there is a possible information disclosure due to a missing permission check.

• Android

In system properties, there is a possible information disclosure due to a missing permission check.

• Android

Android: In ParsedIntentInfo of ParsedIntentInfo.java…

• Android

Android: In RGB_to_BGR1_portable of SkSwizzler_opts.h…

• Android

Android: When extracting the incorrectly formatted flv file, the memory is damaged…

• Android

Android: When extracting the incorrectly formatted avi file, the memory is damaged…

• Android

In ellipsize of Layout.java, there is a possible ANR due to improper input validation.

• Android

Android: In the SELinux policy configured in system_app.te…

• Android

Android: In runTraceIpcStop of ActivityManagerShellCommand.java…

• Android

Android: In openFile of HeapDumpProvider.java…

• Android

In get_sock_stat of xt_qtaguid.c, there is a possible out of bounds read due to a use after free.

• Android

Android: In ih264d_mark_err_slice_skip of ih264d_parse_pslice.c…

• Android

Android: In conditionallyRemoveIdentifiers of SubscriptionController.java…

• Android

Android: In onCreate of ConfirmConnectActivity.java…

• Android

Android: In TouchInputMapper::sync of TouchInputMapper.cpp…

• Android

Android: In sendBroadcastToInstaller of FirstScreenBroadcast.java…

• Android

Android: In getDefaultSmsPackage of RoleManagerService.java…

• Android

Android: In lockAllProfileTasks of RootWindowContainer.java…

• Android

Android: In lockNow of PhoneWindowManager.java…

• Android