Advisories · Technology
OpenHarmony.
Every CVE that names OpenHarmony among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.7 High
Bundlemanager has an authentication bypass vulnerability
- OpenHarmony
- Authentication bypass
- CVSS 6.5 Medium
Telephony has an improper input validation vulnerability
- OpenHarmony
- CWE-20
- CVSS 3.3 Low
Camera has a use after free vulnerability
- OpenHarmony
- Memory corruption
- CVSS 6.5 Medium
AVSession has a use after free vulnerability
- OpenHarmony
- Memory corruption
- CVSS 3.3 Low
Audio has an improper preservation of permissions vulnerability
- OpenHarmony
- CWE-281
- CVSS 3.3 Low
Arkui has a type confusion vulnerability
- OpenHarmony
- Memory corruption
- CVSS 4.3 Medium
Huks has an insecure storage of sensitive information vulnerability
- OpenHarmony
- Information disclosure
- CVSS 4.0 Medium
Background task manager has an improper preservation of permissions vulnerability
- OpenHarmony
- CWE-281
- CVSS 2.9 Low
Arkui has a type confusion vulnerability
- OpenHarmony
- Memory corruption
- CVSS 4.3 Medium
Wlan has a use after free vulnerability
- OpenHarmony
- Memory corruption
- CVSS 2.9 Low
Pasteboard has an out-of-bounds read vulnerability
- OpenHarmony
- Memory corruption
- CVSS 4.7 Medium
Dsoftbus has an improper input validation vulnerability
- OpenHarmony
- CWE-20
- CVSS 2.9 Low
Dsoftbus has an integer overflow vulnerability
- OpenHarmony
- Memory corruption
- CVSS 4.7 Medium
Dsoftbus has an improper input validation vulnerability
- OpenHarmony
- CWE-20
- CVSS 4.2 Medium
Dsoftbus has an out-of-bounds write vulnerability
- OpenHarmony
- Memory corruption
- CVSS 8.2 High
Dsoftbus has a use after free vulnerability
- OpenHarmony
- Memory corruption
- CVSS 2.9 Low
Dsoftbus has an integer overflow vulnerability
- OpenHarmony
- Memory corruption
- CVSS 2.9 Low
Dsoftbus has an out-of-bounds read vulnerability
- OpenHarmony
- Memory corruption
- CVSS 2.9 Low
Dsoftbus has an out-of-bounds read vulnerability
- OpenHarmony
- Memory corruption
- CVSS 4.0 Medium
multimedia audio has a UAF vulnerability
- OpenHarmony
- Memory corruption
- CVSS 4.0 Medium
multimedia player has a UAF vulnerability
- OpenHarmony
- Memory corruption
- CVSS 4.0 Medium
multimedia player has a UAF vulnerability
- OpenHarmony
- Memory corruption
- CVSS 4.0 Medium
multimedia camera has a UAF vulnerability
- OpenHarmony
- Memory corruption
- CVSS 2.9 Low
Liteos-A has a missing release of resource vulnerability
- OpenHarmony
- Denial of service
- CVSS 4.0 Medium
Arkruntime has a buffer overflow vulnerability
- OpenHarmony
- Memory corruption
- CVSS 6.2 Medium
Cert manager has a use of uninitialized resource vulnerability
- OpenHarmony
- Memory corruption
- CVSS 6.2 Medium
Liteos-A has a incorrect default permissions vulnerability
- OpenHarmony
- Broken access control
- CVSS 5.9 Medium
Arkruntime has a type confusion vulnerability
- OpenHarmony
- Memory corruption
- CVSS 6.2 Medium
Arkruntime has a type confusion vulnerability
- OpenHarmony
- Memory corruption
- CVSS 8.4 High
Hiview has an improper preservation of permissions vulnerability
- OpenHarmony
- CWE-281
- CVSS 7.3 High
Liteos-A has a incorrect default permissions vulnerability
- OpenHarmony
- Broken access control
- CVSS 3.9 Low
OpenHarmony v3.2.1 and prior version has a system call function usage error
- OpenHarmony
- CWE-20
- CVSS 6.2 Medium
The bundle management subsystem has a improper input validation when installing a HAP package.
- OpenHarmony
- CWE-20
- CVSS 5.5 Medium
Communication Wi-Fi subsystem has a null pointer reference vulnerability when receving external data.
- OpenHarmony
- CWE-20
- CVSS 7.8 High
The kernel subsystem function check_permission_for_set_tokenid has an UAF vulnerability.
- OpenHarmony
- Memory corruption
- CVSS 6.5 Medium
The kernel subsystem hmdfs has a arbitrary memory accessing vulnerability.
- OpenHarmony
- CWE-20
- CVSS 4.0 Medium
The ArkUI framework subsystem doesn't check the input parameter,causing type confusion and invalid memory access.
- OpenHarmony
- Memory corruption
- CVSS 6.5 Medium
platform_callback_stub in misc subsystem has an authentication bypass vulnerability which allows an "SA relay attack".
- OpenHarmony
- Authentication bypass
- CVSS 6.5 Medium
softbus_client_stub in communication subsystem has an authentication bypass vulnerability which allows an "SA relay attack".
- OpenHarmony
- Authentication bypass
- CVSS 4.0 Medium
Kernel subsystem in kernel_liteos_a has a kernel stack overflow vulnerability when call SysTimerGettime.
- OpenHarmony
- Memory corruption
- CVSS 4.0 Medium
Kernel subsystem in kernel_liteos_a has a kernel stack overflow vulnerability when call SysClockGettime.
- OpenHarmony
- Memory corruption
- CVSS 8.3 High
PIN code is transmitted to the peer device in plain text during cross-device authentication, which reduces the difficulty of man-in-the-middle attacks.
- OpenHarmony
- Authentication bypass
- CVSS 6.2 Medium
Telephony in communication subsystem sends public events with personal data, but the permission is not set.
- OpenHarmony
- Authentication bypass
- CVSS 6.8 Medium
The appspawn and nwebspawn services were found to be vulnerable to buffer overflow vulnerability due to insufficient input validation.
- OpenHarmony
- Memory corruption
- CVSS 4.0 Medium
Kernel subsystem in kernel_liteos_a has a kernel stack overflow vulnerability when call SysClockGetres.
- OpenHarmony
- Memory corruption
- CVSS 6.5 Medium
An abnormal packet recieved when distributedhardware_device_manager joining a network could cause a device reboot.
- OpenHarmony
- Memory corruption
- CVSS 6.2 Medium
Arbitrary file read via download_server.
- OpenHarmony
- CWE-20
- CVSS 8.4 High
Multiple path traversal in appspawn and nwebspawn services.
- OpenHarmony
- Authentication bypass
- CVSS 6.7 Medium
Kernel memory pool override in /dev/mmz_userdev device driver. The impact depends on the privileges of the attacker. The unprivileged process run on the device could disclose sensitive information in…
- OpenHarmony
- Broken access control
- CVSS 8.3 High
Softbus_server in communication subsystem has a authenication bypass vulnerability in a callback handler function. Attackers can launch attacks on distributed networks by sending Bluetooth rfcomm pac…
- OpenHarmony
- Authentication bypass
- CVSS 5.1 Medium
Out-of-bound memory read and write in /dev/mmz_userdev device driver. The impact depends on the privileges of the attacker. The unprivileged process run on the device could read out-of-bound memory l…
- OpenHarmony
- Memory corruption
- CVSS 8.4 High
Startup subsystem missed permission validation in param service. An malicious application installed on the device could elevate its privileges to the root user, disable security features, or cause Do…
- OpenHarmony
- Authentication bypass
- CVSS 6.2 Medium
IPC in communication subsystem has a heap overflow vulnerability. Local attackers can trigger a heap overflow and get network sensitive information.
- OpenHarmony
- Memory corruption
- CVSS 6.2 Medium
Tokensync in security subsystem has a permission bypass vulnerability. LAN attackers can bypass the distributed permission control.To take advantage of this weakness, attackers need another vulnerabi…
- OpenHarmony
- CWE-305
- CVSS 8.8 High
multimedia subsystem has a permission bypass vulnerability. LAN attackers can bypass permission control and get control of camera service.
- OpenHarmony
- CWE-305
- CVSS 6.2 Medium
windowmanager in window subsystem has a permission bypass vulnerability. Local attackers can bypass permission control and get sensitive information.
- OpenHarmony
- CWE-305
- CVSS 7.4 High
Incorrect configuration of the cJSON library lead a Stack overflow vulnerability during recursive parsing. LAN attackers can lead a DoS attack to all network devices.
- OpenHarmony
- CWE-16