Android

In multiple locations, there is a possible way to escape chrome sandbox to attack android system_server due to a use after free.

In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the code.

In multiple locations, there is a possible way to achieve code execution due to an integer overflow.

there is a possible way to bypass due to a logic error in the code.

In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass.

In the Linux kernel, the following vulnerability has been resolved: net: fix __dst_negative_advice() race __dst_negative_advice() does not enforce proper RCU rules when sk->dst_cache must be cleared, leading to possible…

there is a possible way to bypass due to a logic error in the code.

In WorkSource, there is a possible parcel mismatch.

In ep_loop_check_proc of eventpoll.c, there is a possible way to corrupt memory due to a use after free.

In binder_transaction of binder.c, there is a possible out of bounds write due to an incorrect bounds check.

A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel.

The vold volume manager daemon on Android 3.0 and 2.x before 2.3.4 trusts messages that are received from a PF_NETLINK socket, which allows local users to execute arbitrary code and gain root privileges via a negative in…

In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization.

In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition.

In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification due to misleading or insufficient UI.

In hasAccountsOnAnyUser of DevicePolicyManagerService.java, there is a possible way to add a Device Owner after provisioning due to a logic error in the code.

there is a possible Information Disclosure due to uninitialized data.

In bta_ag_parse_cmer of bta_ag_cmd.cc in Android-7.0, Android-7.1.1, Android-7.1.2, Android-8.0, Android-8.1 and Android-9, there is a possible out-of-bounds write due to a missing bounds check.

In HAliasAnalyzer.Query of hydrogen-alias-analysis.h, there is possible memory corruption due to type confusion.

In removeInterfaceAddress of NetworkController.cpp, there is a possible use after free.

A local, arbitrary code execution vulnerability exists in the SplitCompat.install endpoint in Android's Play Core Library versions prior to 1.7.2.

In Contacts Provider, there is a possible way to access the contacts database due to SQL injection.

In btif_dm_data_copy of btif_core.cc, there is a possible out of bounds write due to a buffer overflow.

In sample6 of SkSwizzler.cpp, there is a possible out of bounds write due to improper input validation.

In floor0_inverse1 of floor0.c, there is a possible out of bounds write due to an incorrect bounds check.