In Bluetooth, there is a possible deserialization error due to missing string validation

In libAACdec, there is a possible out of bounds write due to an integer overflow

In CompilationJob::FinalizeJob of compiler.cc, there is a possible remote code execution due to type confusion

In loop of DnsTlsSocket.cpp, there is a possible heap memory corruption due to a use after free

In getReadIndex and getWriteIndex of FifoControllerBase.cpp, there is a possible out-of-bounds write due to an integer overflow

In serviceDied of HalDeathHandlerHidl.cpp, there is a possible memory corruption due to a use after free

In HAliasAnalyzer.Query of hydrogen-alias-analysis.h, there is possible memory corruption due to type confusion

In UpdateLoadElement of ic.cc, there is a possible out-of-bounds write due to type confusion

In CalculateInstanceSizeForDerivedClass of objects.cc, there is possible memory corruption due to an integer overflow

In JSCallTyper of typer.cc, there is an out of bounds write due to an incorrect bounds check

In removeInterfaceAddress of NetworkController.cpp, there is a possible use after free

In bta_ag_parse_cmer of bta_ag_cmd.cc in Android-7.0, Android-7.1.1, Android-7.1.2, Android-8.0, Android-8.1 and Android-9, there is a possible out-of-bounds write due to a…

In ixheaacd_adts_crc_start_reg of ixheaacd_adts_crc_check.c, there is a possible out of bounds write due to a missing bounds check

In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Possible buffer overflow in WLAN function due to lack of input…

In ParsePayloadHeader of payload_metadata.cc, there is a possible out of bounds write due to an integer overflow

A Elevation of privilege vulnerability in the HTC bootloader

In smp_br_state_machine_event of smp_br_main.cc, there is a possible out of bounds write due to memory corruption

In bnep_data_ind of bnep_main.c, there is a possible remote code execution due to a double free

In bta_dm_sdp_result of bta_dm_act.cc, there is a possible out of bounds stack write due to a missing bounds check

In avrc_pars_browsing_cmd of avrc_pars_tg.cc, there is a possible use-after-free due to improper locking

Certain LG devices based on Android 6.0 through 8.1 have incorrect access control for MLT application intents

Certain LG devices based on Android 6.0 through 8.1 have incorrect access control for SystemUI application intents

Certain LG devices based on Android 6.0 through 8.1 have incorrect access control in the GNSS application

The content://wappush content provider in com.android.provider.telephony, as found in some custom ROMs for Android phones, allows SQL injection

While padding or shrinking a nested wmi packet in all Android releases from CAF using the Linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before security patch…

An integer overflow to buffer overflow vulnerability exists in the ADSPRPC heap manager in all Android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using…

An elevation of privilege vulnerability in Qualcomm closed source components

An elevation of privilege vulnerability in Qualcomm closed source components

An elevation of privilege vulnerability in Qualcomm closed source components

An elevation of privilege vulnerability in Qualcomm closed source components

An elevation of privilege vulnerability in Qualcomm closed source components

An elevation of privilege vulnerability in the Qualcomm video driver

A remote code execution vulnerability in the Qualcomm crypto driver

An elevation of privilege vulnerability in Qualcomm closed source components

An elevation of privilege vulnerability in Qualcomm closed source components

An elevation of privilege vulnerability in Qualcomm closed source components

An elevation of privilege vulnerability in Qualcomm closed source components

An elevation of privilege vulnerability in Qualcomm closed source components

An elevation of privilege vulnerability in Qualcomm closed source components

An elevation of privilege vulnerability in Qualcomm closed source components

An elevation of privilege vulnerability in Qualcomm closed source components

An elevation of privilege vulnerability in Qualcomm closed source components

An elevation of privilege vulnerability in Qualcomm closed source components

An elevation of privilege vulnerability in Qualcomm closed source components

An elevation of privilege vulnerability in Qualcomm closed source components

An elevation of privilege vulnerability in Qualcomm closed source components

An elevation of privilege vulnerability in Qualcomm closed source components

In alarm_ready_generic of alarm.cc, there is a possible out of bounds write due to a use after free

In avrc_pars_vendor_cmd of avrc_pars_tg.cc, there is a possible stack corruption due to a missing bounds check

In wl_get_assoc_ies of wl_cfg80211.c, there is a possible out of bounds write due to an incorrect bounds check