Google Android.

An oversight in BCB handling of reboot reason that allows for persistent code execution

• Google Android

Improper input validation in Google Android

• Google Android
• CWE-20

U-Boot shell vulnerability resulting in Privilege escalation in a production device

• Google Android

Missing Permission checks resulting in unauthorized access and Manipulation in KeyChainActivity Application

• Google Android

In dhcp4_SetPDNAddress of dhcp4_Main.c, there is a possible out of bounds write due to a missing bounds check.

• Google Android

In Init of protocolnetadapter.cpp, there is a possible out of bounds read due to a missing bounds check.

• Google Android

Out-of-bounds write in Google Android

• Google Android
• Memory corruption

there is a possible use after free due to a race condition.

• Google Android

In multiple locations, there is a possible null dereference due to a missing null check.

• Google Android

In Init of protocolembmsadapter.cpp, there is a possible out of bounds read due to a missing bounds check.

• Google Android

In the Pixel Camera Driver, there is a possible use after free due to a logic error in the code.

• Google Android

In Init of protocolnetadapter.cpp, there is a possible out of bounds read due to a missing bounds check.

• Google Android

In private_handle_t of mali_gralloc_buffer.h, there is a possible information leak due to a logic error in the code.

• Google Android

In SignalStrengthAdapter::FillGsmSignalStrength() of protocolmiscadapter.cpp, there is a possible out of bounds read due to a missing bounds check.

• Google Android

In cd_ParseMsg of cd_codec.c, there is a possible out of bounds read due to a missing bounds check.

• Google Android

In gpu_pixel_handle_buffer_liveness_update_ioctl of private/google-modules/gpu/mali_kbase/mali_kbase_core_linux.c, there is a possible out of bounds write due to an integer overflow.

• Google Android

In ProtocolNetSimFileInfoAdapter() of protocolnetadapter.cpp, there is a possible out of bounds read due to a missing bounds check.

• Google Android

there is a possible DCK won't be deleted after factory reset due to a logic error in the code.

• Google Android

Improper privilege management in Google Android

• Google Android
• Privilege escalation

there is a possible way for the secure world to write to NS memory due to a logic error in the code.

• Google Android

In ProtocolMiscCarrierConfigSimInfoIndAdapter of protocolmiscadapter.cpp, there is a possible out of bounds read due to a missing bounds check.

• Google Android

In sms_DecodeCodedTpMsg of sms_PduCodec.c, there is a possible out of bounds read due to a heap buffer overflow.

• Google Android

In ppcfw_enable of ppcfw.c, there is a possible EoP due to a missing permission check.

• Google Android

In GetSizeOfEenlRecords of protocoladapter.cpp, there is a possible out of bounds read due to an incorrect bounds check.

• Google Android

In ProtocolMiscATCommandAdapter::Init() of protocolmiscadapter.cpp, there is a possible out of bounds read due to a missing bounds check.

• Google Android

Out-of-bounds read in Google Android

• Google Android
• Memory corruption

In Init of protocolcalladapter.cpp, there is a possible out of bounds read due to a missing bounds check.

• Google Android

In parse_gap_data of utils.cc, there is a possible out of bounds read due to a missing bounds check.

• Google Android

In the APEX module framework of AOSP, there is a possible malicious update to platform components due to improperly used crypto.

• Google Android

In checkKeyIntentParceledCorrectly of AccountManagerService.java, there is a possible way to launch arbitrary activities using system privileges due to Parcel Mismatch.

• Google Android

In CreateAudioBroadcast of broadcaster.cc, there is a possible out of bounds write due to a missing bounds check.

• Google Android

In CreateAudioBroadcast of broadcaster.cc, there is a possible out of bounds write due to a missing bounds check.

• Google Android

In fixUpIncomingShortcutInfo of ShortcutService.java, there is a possible way to view another user's image due to a confused deputy.

• Google Android

In multiple functions of btm_ble_gap.cc, there is a possible out of bounds write due to a missing bounds check.

• Google Android

In multiple locations, there is a possible way to corrupt memory due to a double free.

• Google Android

In mOnDone of NotificationConversationInfo.java, there is a possible way to access app notification data of another user due to a logic error in the code.

• Google Android

In hasPermissionForActivity of PackageManagerHelper.java, there is a possible URI grant due to improper input validation.

• Google Android

In OpRecordAudioMonitor::onFirstRef of AudioRecordClient.cpp, there is a possible way to record audio from the background due to a missing flag.

• Google Android

In createDontSendToRestrictedAppsBundle of PendingIntentUtils.java, there is a possible background activity launch due to a missing check.

• Google Android

In keyguardGoingAway of ActivityTaskManagerService.java, there is a possible lock screen bypass due to a missing permission check.

• Google Android

In verifyShortcutInfoPackage of ShortcutService.java, there is a possible way to see another user's image due to a confused deputy.

• Google Android

In onTransact of IncidentService.cpp, there is a possible out of bounds write due to memory corruption.

• Google Android

In BTM_BleVerifySignature of btm_ble.cc, there is a possible way to bypass signature validation due to side channel information disclosure.

• Google Android

In getCredentialManagerPolicy of DevicePolicyManagerService.java, there is a possible method for users to select credential managers without permission due to a missing permission check.

• Google Android

Use after free in Google Android

• Google Android
• Memory corruption

In transcodeQ*ToFloat of btif_avrcp_audio_track.cc, there is a possible out of bounds write due to a missing bounds check.

• Google Android

In run of MDnsSdListener.cpp, there is a possible memory corruption due to a use after free.

• Google Android

In parse_gap_data of utils.cc, there is a possible out of bounds read due to a missing bounds check.

• Google Android

In modify_for_next_stage of fdt.rs, there is a possible way to render KASLR ineffective due to improperly used crypto.

• Google Android

In loadMediaDataInBgForResumption of MediaDataManager.kt, there is a possible way to view another user's images due to a confused deputy.

• Google Android

In multiple functions of btm_ble_gap.cc, there is a possible out of bounds write due to a logic error in the code.

• Google Android

In injectSendIntentSender of ShortcutService.java, there is a possible background activity launch due to a permissions bypass.

• Google Android

In a2dp_vendor_opus_decoder_decode_packet of a2dp_vendor_opus_decoder.cc, there is a possible out of bounds write due to a heap buffer overflow.

• Google Android

Race condition in Google Android

• Google Android
• Race condition

Incorrect default permissions in Google Android

• Google Android
• Broken access control

In forceReplaceShortcutInner of ShortcutPackage.java, there is a possible way to register unlimited packages due to a missing bounds check.

• Google Android

In saveToXml of PersistableBundle.java, invalid data could lead to local persistent denial of service with no additional execution privileges needed.

• Google Android

In visitUris of Notification.java, there is a possible cross-user media read due to Confused Deputy.

• Google Android

In RGXDestroyHWRTData of rgxta3d.c, there is a possible arbitrary code execution due to an uncaught exception.

• Google Android

In visitUris of Notification.java, there is a possible way to display images from another user due to a confused deputy.

• Google Android