Android vulnerabilities

1,228 known vulnerabilities in Android from Google. 1,223 are rated high or critical, and 16 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.8 High severity

  SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization

  CVE-2022-39098Dec 6, 2022Unisoc

  In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed.

• 7.8 High severity

  SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization

  CVE-2022-39097Dec 6, 2022Unisoc

  In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed.

• 7.8 High severity

  SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization

  CVE-2022-39096Dec 6, 2022Unisoc

  In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed.

• 7.8 High severity

  SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization

  CVE-2022-39095Dec 6, 2022Unisoc

  In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed.

• 7.8 High severity

  SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization

  CVE-2022-39094Dec 6, 2022Unisoc

  In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed.

• 7.8 High severity

  SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization

  CVE-2022-39093Dec 6, 2022Unisoc

  In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed.

• 7.8 High severity

  SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization

  CVE-2022-39092Dec 6, 2022Unisoc

  In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed.

• 7.8 High severity

  SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization

  CVE-2022-39091Dec 6, 2022Unisoc

  In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed.

• 7.8 High severity

  SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization

  CVE-2022-39090Dec 6, 2022Unisoc

  In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed.

• 7.8 High severity

  Samsung Mobile Devices: Out-of-bounds Write

  CVE-2022-39882Nov 9, 2022Samsung

  Heap overflow vulnerability in sflacf_fal_bytes_peek function in libsmat.so library prior to SMR Nov-2022 Release 1 allows local attacker to execute arbitrary code.

• 7.8 High severity

  Improper input validation vulnerability in DualOutFocusViewer prior to SMR Nov-2022 Release 1…

  CVE-2022-39880Nov 9, 2022Samsung

  Improper input validation vulnerability in DualOutFocusViewer prior to SMR Nov-2022 Release 1 allows local attacker to perform an arbitrary code execution.

• 7.8 High severity

  MT6739, MT6761, MT6762, MT6763, MT6765…: Deserialization of Untrusted Data

  CVE-2022-32601Nov 8, 2022MediaTek

  In telephony, there is a possible permission bypass due to a parcel format mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07319132; Issue

• 7.8 High severity

  SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization

  CVE-2022-39111Oct 14, 2022Unisoc

  In Music service, there is a missing permission check. This could lead to elevation of privilege in Music service with no additional execution privileges needed.

• 7.8 High severity

  SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization

  CVE-2022-39110Oct 14, 2022Unisoc

  In Music service, there is a missing permission check. This could lead to elevation of privilege in Music service with no additional execution privileges needed.

• 7.8 High severity

  SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization

  CVE-2022-39109Oct 14, 2022Unisoc

  In Music service, there is a missing permission check. This could lead to elevation of privilege in Music service with no additional execution privileges needed.

• 7.8 High severity

  SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization

  CVE-2022-39108Oct 14, 2022Unisoc

  In Music service, there is a missing permission check. This could lead to elevation of privilege in Music service with no additional execution privileges needed.

• 7.8 High severity

  SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization

  CVE-2022-39107Oct 14, 2022Unisoc

  In Soundrecorder service, there is a missing permission check. This could lead to elevation of privilege in Soundrecorder service with no additional execution privileges needed.

• 7.8 High severity

  SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization

  CVE-2022-39080Oct 14, 2022Unisoc

  In messaging service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additional execution privileges needed.

• 7.8 High severity

  SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization

  CVE-2022-38698Oct 14, 2022Unisoc

  In messaging service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additional execution privileges needed.

• 7.8 High severity

  SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization

  CVE-2022-38670Oct 14, 2022Unisoc

  In soundrecorder service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additional execution privileges needed.

• 7.8 High severity

  SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization

  CVE-2022-38669Oct 14, 2022Unisoc

  In soundrecorder service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additional execution privileges needed.

• 7.8 High severity

  SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization

  CVE-2022-2985Oct 14, 2022Unisoc

  In music service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additional execution privileges needed.

• 7.5 High severity

  In ril, there is a possible system crash due to an incorrect bounds check.

  CVE-2022-32591Oct 7, 2022MediaTek

  In ril, there is a possible system crash due to an incorrect bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07257259; Issue ID: ALPS072572

• 7.5 High severity

  MT6761, MT6762, MT6765, MT6768, MT6779…: Improper Resource Shutdown or Release

  CVE-2022-32589Oct 7, 2022MediaTek

  In Wi-Fi driver, there is a possible way to disconnect Wi-Fi due to an improper resource release. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS0703060

• 7.8 High severity

  MT6739, MT6761, MT6762, MT6763, MT6765…: Deserialization of Untrusted Data

  CVE-2022-26472Oct 7, 2022MediaTek

  In ims, there is a possible escalation of privilege due to a parcel format mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07319095; Issue

• 7.8 High severity

  MT6580, MT6739, MT6761, MT6765, MT6768…: Deserialization of Untrusted Data

  CVE-2022-26471Oct 7, 2022MediaTek

  In telephony, there is a possible escalation of privilege due to a parcel format mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07319121;

• 7.8 High severity

  Samsung Mobile Devices: Out-of-bounds Write

  CVE-2022-39852Oct 7, 2022Samsung

  A heap-based overflow vulnerability in makeContactAGIF in libagifencoder.quram.so library prior to SMR Oct-2022 Release 1 allows attacker to perform code execution.

• 7.8 High severity

  SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization

  CVE-2022-39119Sep 9, 2022Unisoc

  In network service, there is a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed

• 7.8 High severity

  Samsung Mobile Devices: Out-of-bounds Write

  CVE-2022-36863Sep 9, 2022Samsung

  A heap-based overflow vulnerability in GetCorrectDbLanguageTypeEsPKc function in libSDKRecognitionText.spensdk.samsung.so library prior to SMR Sep-2022 Release 1 allows attacker to cause memory access fault.

• 7.8 High severity

  Samsung Mobile Devices: Out-of-bounds Write

  CVE-2022-36862Sep 9, 2022Samsung

  A heap-based overflow vulnerability in HWR::EngineCJK::Impl::Construct() in libSDKRecognitionText.spensdk.samsung.so library prior to SMR Sep-2022 Release 1 allows attacker to cause memory access fault.

• 7.8 High severity

  Samsung Mobile Devices: Out-of-bounds Write

  CVE-2022-36860Sep 9, 2022Samsung

  A heap-based overflow vulnerability in LoadEnvironment function in libSDKRecognitionText.spensdk.samsung.so library prior to SMR Sep-2022 Release 1 allows attacker to cause memory access fault.

• 7.8 High severity

  Samsung Mobile Devices: Out-of-bounds Write

  CVE-2022-36858Sep 9, 2022Samsung

  A heap-based overflow vulnerability in GetCorrectDbLanguageTypeEsPKc() function in libSDKRecognitionText.spensdk.samsung.so library prior to SMR Sep-2022 Release 1 allows attacker to cause memory access fault.

• 7.8 High severity

  Samsung Mobile Devices: Use After Free

  CVE-2022-36849Sep 9, 2022Samsung

  Use after free vulnerability in sdp_mm_set_process_sensitive function of sdpmm driver prior to SMR Sep-2022 Release 1 allows attackers to perform malicious actions.

• 7.8 High severity

  Samsung Mobile Devices: Out-of-bounds Write

  CVE-2022-36846Sep 9, 2022Samsung

  A heap-based overflow vulnerability in ConstructDictionary function in libSDKRecognitionText.spensdk.samsung.so library prior to SMR Sep-2022 Release 1 allows attacker to cause memory access fault.

• 7.8 High severity

  Samsung Mobile Devices: Out-of-bounds Write

  CVE-2022-36845Sep 9, 2022Samsung

  A heap-based overflow vulnerability in MHW_RECOG_LIB_INFO function in libSDKRecognitionText.spensdk.samsung.so library prior to SMR Sep-2022 Release 1 allows attacker to cause memory access fault.

• 7.8 High severity

  Samsung Mobile Devices: Out-of-bounds Write

  CVE-2022-36844Sep 9, 2022Samsung

  A heap-based overflow vulnerability in HWR::EngJudgeModel::Construct() in libSDKRecognitionText.spensdk.samsung.so library prior to SMR Sep-2022 Release 1 allows attacker to cause memory access fault.

• 7.8 High severity

  Samsung Mobile Devices: Out-of-bounds Write

  CVE-2022-36843Sep 9, 2022Samsung

  A heap-based overflow vulnerability in MHW_RECOG_LIB_INFO function in libSDKRecognitionText.spensdk.samsung.so library prior to SMR Sep-2022 Release 1 allows attacker to cause memory access fault.

• 7.8 High severity

  Samsung Mobile Devices: Out-of-bounds Write

  CVE-2022-36842Sep 9, 2022Samsung

  A heap-based overflow vulnerability in prepareRecogLibrary function in libSDKRecognitionText.spensdk.samsung.so library prior to SMR Sep-2022 Release 1 allows attacker to cause memory access fault.

• 7.8 High severity

  Samsung Mobile Devices: Out-of-bounds Write

  CVE-2022-36841Sep 9, 2022Samsung

  A heap-based overflow vulnerability in PrepareRecogLibrary_Part function in libSDKRecognitionText.spensdk.samsung.so library prior to SMR Sep-2022 Release 1 allows attacker to cause memory access fault.

• 7.8 High severity

  MT6580, MT6735, MT6737, MT6739, MT6761…: Use of Externally-Controlled Input to Select Classes or Code

  CVE-2022-26469Sep 6, 2022MediaTek

  In MtkEmail, there is a possible escalation of privilege due to fragment injection. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07216598; Issue