Vulnerabilities

In Contacts Provider, there is a possible way to access the contacts database due to SQL injection.

In multiple locations, there is a possible way to achieve code execution due to an integer overflow.

In hasAccountsOnAnyUser of DevicePolicyManagerService.java, there is a possible way to add a Device Owner after provisioning due to a logic error in the code.

In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass.

In multiple locations, there is a possible way to escape chrome sandbox to attack android system_server due to a use after free.

There exists a TOCTOU race condition in TvSettings AppRestrictionsFragment.java that lead to start of attacker supplied activity in Settings’ context, i.e.

In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization.

EvilVideo vulnerability allows sending malicious apps disguised as videos in Telegram for Android application affecting versions 10.14.4 and older.

there is a possible way to bypass due to a logic error in the code.

In the Linux kernel, the following vulnerability has been resolved: net: fix __dst_negative_advice() race __dst_negative_advice() does not enforce proper RCU rules when sk->dst_cache must be cleared, leading to possible…

there is a possible way to bypass due to a logic error in the code.

there is a possible Information Disclosure due to uninitialized data.

In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the code.

In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification due to misleading or insufficient UI.

In WorkSource, there is a possible parcel mismatch.

In ep_loop_check_proc of eventpoll.c, there is a possible way to corrupt memory due to a use after free.

In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition.

A local, arbitrary code execution vulnerability exists in the SplitCompat.install endpoint in Android's Play Core Library versions prior to 1.7.2.

In binder_transaction of binder.c, there is a possible out of bounds write due to an incorrect bounds check.

A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel.

In uvc_parse_standard_control of uvc_driver.c, there is a possible out-of-bound read due to improper input validation.

In nfa_rw_store_ndef_rx_buf of nfa_rw_act.cc, there is a possible out-of-bound write due to a missing bounds check.

In areNotificationsEnabledForPackage of NotificationManagerService.java, there is a possible permissions bypass due to a missing permissions check.

In the Bluetooth Low Energy (BLE) specification, there is a provided example Long Term Key (LTK).

In HAliasAnalyzer.Query of hydrogen-alias-analysis.h, there is possible memory corruption due to type confusion.