Vulnerabilities

In setAllowedCarriers of PhoneInterfaceManager.java, there is a possible way to disable carrier restrictions due to a logic error in the code.

In MmsSmsProvider of MmsSmsProvider.java, there is a possible way to retrieve sensitive information due to a missing permission check.

In Contacts Provider, there is a possible way to access the contacts database due to SQL injection.

In Telecomm, there is a possible way to initiate an unauthorized phone call due to a permissions bypass.

In Nfc::eventCallback() of Nfc.h, there is a possible use after free due to a race condition.

In tryStartActivity of NfcDispatcher.java, there is a possible automatic special app access permission assignment due to an insecure default value.

In NFC, there is a possible way to spoof an NFC event due to a missing permission check.

In SettingsLib, there is a possible missing permission check due to a logic error in the code.

In PackageInstaller.Session#transfer of frameworks/base/services/core/java/com/android/server/pm/PackageInstallerSession.java, there is a possible memory exhaustion attack due to a logic error in the code.

In multiple places, there is a possible persistent denial of service due to resource exhaustion.

In Package Manager, there is a possible device lock controller bypass due to a missing permission check.

In createSessionInternal of PackageInstallerService.java, there is a possible method to remove a DPC app from a managed device without DO consent due to desync from persistence.