Product: AndroidVersions: Android kernelAndroid ID: A-127973231References: Upstream kernel

There is a possible out of bounds write due to a missing bounds check.Product: AndroidVersions: Android SoCAndroid ID: A-170378843

There is a possible out of bounds write due to a missing bounds check.Product: AndroidVersions: Android SoCAndroid ID: A-170367562

There is a possible out of bounds write due to a missing bounds check.Product: AndroidVersions: Android SoCAndroid ID: A-170372514

In exif_entry_get_value of exif-entry.c, there is a possible out of bounds write due to an integer overflow

There is a possible out of bounds write due to a missing bounds check.Product: AndroidVersions: Android SoCAndroid ID: A-168251617

There is a possible out of bounds write due to a missing bounds check.Product: AndroidVersions: Android SoCAndroid ID: A-168264528

There is a possible out of bounds write due to a missing bounds check.Product: AndroidVersions: Android SoCAndroid ID: A-168264527

An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), Q(10.0), and R(11.0) software

An issue was discovered in TimaService on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software

In Bluetooth, there is a possible out of bounds write due to a missing bounds check

In UrlQuerySanitizer, there is a possible improper input validation

In allocExcessBits of bitalloc.c, there is a possible out of bounds write due to an incorrect bounds check

There is a possible out of bounds write due to an incorrect bounds check.Product: AndroidVersions: Android SoCAndroid ID: A-160812576

There is a possible out of bounds write due to an incorrect bounds check.Product: AndroidVersions: Android SoCAndroid ID: A-160812574

There is a possible out of bounds write due to an incorrect bounds check.Product: AndroidVersions: Android SoCAndroid ID: A-156333725

There is a possible out of bounds write due to an incorrect bounds check.Product: AndroidVersions: Android SoCAndroid ID: A-149871374

An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, 9.0, and 10 software

An issue was discovered on LG mobile devices with Android OS 10 software

An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (Exynos chipsets) software

An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software

An issue was discovered on LG mobile devices with Android OS 9 and 10 software

An issue was discovered on LG mobile devices with Android OS 9 and 10 software on the VZW network

An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, 9, and 10 software

An issue was discovered on LG mobile devices with Android OS 10 software

An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software

An issue was discovered on Samsung mobile devices with Q(10.0) (exynos9830 chipsets) software

An issue was discovered on Samsung mobile devices with Q(10.0) (exynos9830 chipsets) software

An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software

There is a possible memory corruption due to a use after free.Product: AndroidVersions: Android SoCAndroid ID: A-152647365

There is a possible memory corruption due to a use after free.Product: AndroidVersions: Android SoCAndroid ID: A-152236803

There is a possible out of bounds write due to an incorrect bounds check

There is a possible out of bounds write due to an incorrect bounds check

In a2dp_vendor_ldac_decoder_decode_packet of a2dp_vendor_ldac_decoder.cc, there is a possible out of bounds write due to a missing bounds check

In FastKeyAccumulator::GetKeysSlow of keys.cc, there is a possible out of bounds write due to type confusion

In crus_sp_shared_ioctl we first copy 4 bytes from userdata into "size" variable, and then use that variable as the size parameter for "copy_from_user", ending up overwriting…

Function abc_pcie_issue_dma_xfer_sync creates a transfer object, adds it to the session object then continues to work with it

This is an unbounded write into kernel global memory, via a user-controlled buffer size.Product: AndroidVersions: Android kernelAndroid ID: A-135130450

In RW_T4tPresenceCheck of rw_t4t.cc, there is a possible out of bounds write due to a missing bounds check

In showSecurityFields of WifiConfigController.java there is a possible credential leak due to a confused deputy

In get_element_attr_rsp of btif_rc.cc, there is a possible out of bounds write due to a missing bounds check

In aes_cmac of aes_cmac.cc, there is a possible out of bounds write due to an integer overflow

An issue was discovered on LG mobile devices with Android OS 9 and 10 (MTK chipsets)

An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 (MTK chipsets)

An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 (MTK chipsets)

An issue was discovered on Samsung mobile devices with O(8.x) (with TEEGRIS) software

An issue was discovered on Samsung mobile devices with Q(10.0) (with TEEGRIS on Exynos chipsets) software

An issue was discovered on Samsung mobile devices with O(8.x) and P(9.0) (Exynos 7570 chipsets) software

Airbrush FW's scratch memory allocator is susceptible to numeric overflow

In a2dp_aac_decoder_cleanup of a2dp_aac_decoder.cc, there is a possible invalid free due to memory corruption