Android vulnerabilities
1,228 known vulnerabilities in Android from Google. 1,223 are rated high or critical, and 16 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.8 Critical severity
MT6580, MT6735, MT6737, MT6739, MT6750S…: Out-of-bounds Write
In BT firmware, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06784478; Issue ID: A
- 7.1 High severity
Samsung Mobile Devices: Improper Authentication
Improper access control vulnerability in Samsung Dex for PC prior to SMR Aug-2022 Release 1 allows local attackers to scan and connect to PC by unprotected binder call.
- 7.8 High severity
MT6580, MT6735, MT6739, MT6757, MT6761…: Missing Authorization
In cta, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Pat
- 7.8 High severity
Implicit Intent hijacking vulnerability in Finder prior to SMR Jul-2022 Release 1 allow allows…
Implicit Intent hijacking vulnerability in Finder prior to SMR Jul-2022 Release 1 allow allows attackers to launch certain activities with privilege of Finder.
- 7.8 High severity
Samsung Mobile Devices: Improper Authentication
Improper authentication vulnerability in AppLock prior to SMR Jul-2022 Release 1 allows attacker to bypass password confirm activity by hijacking the implicit intent.
- 7.8 High severity
Implicit Intent hijacking vulnerability in AppLinker prior to SMR Jul-2022 Release 1 allow…
Implicit Intent hijacking vulnerability in AppLinker prior to SMR Jul-2022 Release 1 allow allows attackers to launch certain activities with privilege of AppLinker.
- 7.8 High severity
MT6580, MT6735, MT6739, MT6761, MT6765…: Missing Authorization
In Autoboot, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06713894; Issu
- 8.8 High severity
MT8167S, MT8175, MT8183, MT8362A, MT8365, MT8385: Out-of-bounds Write
In Bluetooth, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06784351; Issue
- 8.8 High severity
MT8167, MT8175, MT8183, MT8362A, MT8365, MT8385: Out-of-bounds Write
In Bluetooth, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06784430; Issue
- 7.0 High severity
MT6768, MT6769, MT6781, MT6785, MT6789…: Concurrent Execution using Shared Resource with Improper Synchronization
In GPU, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07044730; Issue ID: ALPS07044730
- 7.8 High severity
Unprotected component vulnerability in DeviceSearchTrampoline in SecSettingsIntelligence prior…
Unprotected component vulnerability in DeviceSearchTrampoline in SecSettingsIntelligence prior to SMR Jun-2022 Release 1 allows local attackers to launch activities of SecSettingsIntelligence.
- 9.8 Critical severity
Samsung Mobile Devices: Improper Authorization
Implicit Intent hijacking vulnerability in Samsung Account prior to SMR Jun-2022 Release 1 allows attackers to bypass user confirmation of Samsung Account.
- 7.5 High severity
MT6833, MT6853, MT6877, MT6885, MT6889…: Improper Validation of Integrity Check Value
In WIFI Firmware, there is a possible system crash due to a missing count check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06468894; Issue ID: ALPS
- 8.8 High severity
MT6761, MT6762, MT6765, MT6768, MT6769…: Use After Free
In WIFI Firmware, there is a possible memory corruption due to a use after free. This could lead to remote escalation of privilege, when devices are connecting to the attacker-controllable Wi-Fi hotspot, with no additional execution privileges needed. User int
- 7.8 High severity
MT6580, MT6735, MT6737, MT6739, MT6750…: Integer Overflow or Wraparound
In ion, there is a possible use after free due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06371108; Issue ID: ALPS06371
- 8.4 High severity
MT6580, MT6735, MT6737, MT6739, MT6750…: Improper Handling of Exceptional Conditions
In ion, there is a possible use after free due to incorrect error handling. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06366069; Issue ID: ALPS
- 7.1 High severity
Improper validation of removing package name in Galaxy Themes prior to SMR May-2022 Release 1…
Improper validation of removing package name in Galaxy Themes prior to SMR May-2022 Release 1 allows attackers to uninstall arbitrary packages without permission. The patch adds proper validation logic for removing package name.
- 7.0 High severity
MT6580, MT6735, MT6737, MT6739, MT6750…: Time-of-check Time-of-use (TOCTOU) Race Condition
In ion, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06399915; Issue ID: ALPS06399901
- 7.8 High severity
MT6580, MT6739, MT6761, MT6762, MT6765…: Out-of-bounds Write
In aee daemon, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06296442; Issue ID
- 7.8 High severity
MT6731, MT6732, MT6735, MT6737, MT6739…: Missing Authorization
In telephony, there is a possible way to disable receiving SMS messages due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch I
- 7.8 High severity
MT6580, MT6731, MT6739, MT6761, MT6762…: Improper Handling of Exceptional Conditions
In aee driver, there is a possible reference count mistake due to incorrect error handling. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06209201; Issue
- 7.8 High severity
MT6731, MT6732, MT6735, MT6737, MT6739…: Missing Authorization
In telephony, there is a possible way to disable receiving emergency broadcasts due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- 7.8 High severity
Samsung Mobile Devices: Improper Limitation of a Pathname to a Restricted Directory
Improper access control and path traversal vulnerability in Storage Manager and Storage Manager Service prior to SMR Apr-2022 Release 1 allow local attackers to access arbitrary system files without a proper permission. The patch adds proper validation logic t
- 7.0 High severity
Samsung Mobile Devices: Use After Free
Use after free vulnerability in dsp_context_unload_graph function of DSP driver prior to SMR Apr-2022 Release 1 allows attackers to perform malicious actions.
- 7.1 High severity
Samsung Mobile Devices: Out-of-bounds Read
Improper size check in sapefd_parse_meta_HEADER function of libsapeextractor library prior to SMR Apr-2022 Release 1 allows out of bounds read via a crafted media file.
- 7.1 High severity
Samsung Mobile Devices: Out-of-bounds Read
Improper size check of in sapefd_parse_meta_DESCRIPTION function of libsapeextractor library prior to SMR Apr-2022 Release 1 allows out of bounds read via a crafted media file
- 7.1 High severity
Samsung Mobile Devices: Out-of-bounds Read
Improper size check in sapefd_parse_meta_HEADER_old function of libsapeextractor library prior to SMR Apr-2022 Release 1 allows out of bounds read via a crafted media file.
- 7.2 High severity
Samsung Mobile Devices: Out-of-bounds Write
Improper input validation vulnerability in parser_iloc and sheifd_find_itemIndexin fuctions of libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds write by privileged attacker.
- 7.2 High severity
Samsung Mobile Devices: Out-of-bounds Write
Improper input validation vulnerability in parser_infe and sheifd_find_itemIndexin fuctions of libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds write by privileged attackers.
- 9.8 Critical severity
Samsung Mobile Devices: Out-of-bounds Write
Heap-based buffer overflow vulnerability in parser_ipma function of libsimba library prior to SMR Apr-2022 Release 1 allows code execution by remote attackers.
- 9.8 Critical severity
Samsung Mobile Devices: Out-of-bounds Write
Heap-based buffer overflow vulnerability in sheifd_get_info_image function in libsimba library prior to SMR Apr-2022 Release 1 allows code execution by remote attacker.
- 9.8 Critical severity
Samsung Mobile Devices: Out-of-bounds Write
Heap-based buffer overflow vulnerability in parser_single_iref function in libsimba library prior to SMR Apr-2022 Release 1 allows code execution by remote attacker.
- 9.8 Critical severity
Samsung Mobile Devices: Out-of-bounds Write
Heap-based buffer overflow vulnerability in parser_infe function in libsimba library prior to SMR Apr-2022 Release 1 allows code execution by remote attacker.
- 9.8 Critical severity
Samsung Mobile Devices: Out-of-bounds Write
Heap-based buffer overflow vulnerability in parser_iloc function in libsimba library prior to SMR Apr-2022 Release 1 allows code execution by remote attacker.
- 9.8 Critical severity
Samsung Mobile Devices: NULL Pointer Dereference
Null pointer dereference vulnerability in parser_hvcC function of libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds write by remote attackers.
- 9.1 Critical severity
Samsung Mobile Devices: NULL Pointer Dereference
Null pointer dereference vulnerability in parser_infe function of libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds read by remote attackers.
- 9.8 Critical severity
Samsung Mobile Devices: Out-of-bounds Write
Heap-based buffer overflow vulnerability in sheifd_create function of libsimba library prior to SMR Apr-2022 Release 1 allows code execution by remote attackers.
- 9.8 Critical severity
Samsung Mobile Devices: NULL Pointer Dereference
Null pointer dereference vulnerability in parser_unknown_property function in libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds write by remote attacker.
- 9.8 Critical severity
Samsung Mobile Devices: NULL Pointer Dereference
Null pointer dereference vulnerability in parser_ispe function in libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds write by remote attacker.
- 9.8 Critical severity
Samsung Mobile Devices: NULL Pointer Dereference
Null pointer dereference vulnerability in parser_colr function in libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds write by remote attacker.