remap_pfn_range' here may map out of size kernel memory (for example, may map the kernel area), and because the 'vma->vm_page_prot' can also be controlled by userspace, so…

Improper input validation in baseband prior to SMR Aug-2022 Release 1 allows attackers to cause integer overflow to heap overflow

'remap_pfn_range' here may map out of size kernel memory (for example, may map the kernel area), and because the 'vma->vm_page_prot' can also be controlled by userspace, so…

In bta_hf_client_handle_cind_list_item of bta_hf_client_at.cc, there is a possible out of bounds write due to a missing bounds check

In read_attr_value of gatt_db.cc, there is a possible out of bounds write due to a missing bounds check

android exported is used to set third-party app access permissions, and the default value of intent-filter is true

The UE and the EMM communicate with each other using NAS messages

Product: AndroidVersions: Android kernelAndroid ID: A-209324757References: N/A

Product: AndroidVersions: Android kernelAndroid ID: A-207116951References: N/A

Product: AndroidVersions: Android kernelAndroid ID: A-215565667References: N/A

Product: AndroidVersions: Android kernelAndroid ID: A-209421931References: N/A

Product: AndroidVersions: Android kernelAndroid ID: A-204956204References: N/A

Product: AndroidVersions: Android kernelAndroid ID: A-204891956References: N/A

Product: AndroidVersions: Android kernelAndroid ID: A-210083655References: N/A

In startLegacyVpnPrivileged of Vpn.java, there is a possible way to retrieve VPN credentials due to a protocol downgrade attack

In read_multi_rsp of gatt_sr.cc, there is a possible out of bounds write due to an incorrect bounds check

In transportDec_OutOfBandConfig of tpdec_lib.cpp, there is a possible out of bounds write due to a heap buffer overflow

In ce_t4t_data_cback of ce_t4t.cc, there is a possible out of bounds write due to a double free

Implicit Intent hijacking vulnerability in Samsung Account prior to SMR Jun-2022 Release 1 allows attackers to bypass user confirmation of Samsung Account

Product: AndroidVersions: Android kernelAndroid ID: A-203213034References: N/A

Heap-based buffer overflow vulnerability in parser_ipma function of libsimba library prior to SMR Apr-2022 Release 1 allows code execution by remote attackers

Heap-based buffer overflow vulnerability in sheifd_get_info_image function in libsimba library prior to SMR Apr-2022 Release 1 allows code execution by remote attacker

Heap-based buffer overflow vulnerability in parser_single_iref function in libsimba library prior to SMR Apr-2022 Release 1 allows code execution by remote attacker

Heap-based buffer overflow vulnerability in parser_infe function in libsimba library prior to SMR Apr-2022 Release 1 allows code execution by remote attacker

Heap-based buffer overflow vulnerability in parser_iloc function in libsimba library prior to SMR Apr-2022 Release 1 allows code execution by remote attacker

Null pointer dereference vulnerability in parser_hvcC function of libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds write by remote attackers

Heap-based buffer overflow vulnerability in sheifd_create function of libsimba library prior to SMR Apr-2022 Release 1 allows code execution by remote attackers

Null pointer dereference vulnerability in parser_unknown_property function in libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds write by remote attacker

Null pointer dereference vulnerability in parser_ispe function in libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds write by remote attacker

Null pointer dereference vulnerability in parser_colr function in libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds write by remote attacker

Null pointer dereference vulnerability in parser_auxC function in libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds write by remote attacker

Null pointer dereference vulnerability in parser_irot function in libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds write by remote attacker

Product: AndroidVersions: Android kernelAndroid ID: A-208229524References: N/A

Product: AndroidVersions: Android kernelAndroid ID: A-209014813References: N/A

Product: AndroidVersions: Android kernelAndroid ID: A-207433926References: N/A

Product: AndroidVersions: Android kernelAndroid ID: A-202160245References: N/A

In gatt_process_notification of gatt_cl.cc, there is a possible out of bounds write due to an incorrect bounds check

Improper boundary check in UWB stack prior to SMR Mar-2022 Release 1 allows arbitrary code execution

Improper input validation in Exynos baseband prior to SMR Feb-2022 Release 1 allows attackers to send arbitrary NAS signaling messages with fake base station

In GKI_getbuf of gki_buffer.cc, there is a possible out of bounds write due to a heap buffer overflow

ismsEx service is a vendor service in unisoc equipment。ismsEx service is an extension of sms system service，but it does not check the permissions of the caller，resulting in…

Summary:Product: AndroidVersions: Android SoCAndroid ID: A-204686438

In doRead of SimpleDecodingSource.cpp, there is a possible out of bounds write due to an incorrect bounds check

Hacker one bug ID: 1343975Product: AndroidVersions: Android SoCAndroid ID: A-204256722

Product: AndroidVersions: Android kernelAndroid ID: A-192641593References: N/A

Product: AndroidVersions: Android kernelAndroid ID: A-199805112References: N/A

Product: AndroidVersions: Android kernelAndroid ID: A-199809304References: N/A

Product: AndroidVersions: Android kernelAndroid ID: A-126949257References: N/A

In NfcTag::discoverTechnologies (activation) of NfcTag.cpp, there is a possible out of bounds write due to an incorrect bounds check

In Android TV , there is a possible silent pairing due to lack of rate limiting in the pairing flow