Android

CVE-2021-0676 Dec 17, 17:15 MEDIUM This Month

In geniezone driver, there is a possible out of bounds read due to an incorrect bounds check. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. No vendor patch available.

CVE-2021-0674 Dec 17, 17:15 MEDIUM This Month

In alac decoder, there is a possible out of bounds read due to an incorrect bounds check. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.

CVE-2021-0673 Dec 17, 17:15 HIGH POC This Week

In Audio Aurisys HAL, there is a possible permission bypass due to a missing permission check. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.

CVE-2021-39657 Dec 15, 19:15 MEDIUM PATCH This Month

In ufshcd_eh_device_reset_handler of ufshcd.c, there is a possible out of bounds read due to a missing bounds check. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.

CVE-2021-39656 Dec 15, 19:15 MEDIUM PATCH This Month

In __configfs_open_file of file.c, there is a possible use-after-free due to improper locking. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.

CVE-2021-39655 Dec 15, 19:15 CRITICAL PATCH Act Now

Product: AndroidVersions: Android kernelAndroid ID: A-192641593References: N/A. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2021-39653 Dec 15, 19:15 HIGH This Week

In (TBD) of (TBD), there is a possible way to boot with a hidden debug policy due to a missing warning to the user. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.

CVE-2021-39652 Dec 15, 19:15 MEDIUM PATCH This Month

In sec_ts_parsing_cmds of (TBD), there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.

CVE-2021-39651 Dec 15, 19:15 HIGH PATCH This Week

In TBD of TBD, there is a possible way to access PIN protected settings bypassing PIN confirmation due to a missing permission check. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.

CVE-2021-39650 Dec 15, 19:15 MEDIUM PATCH This Month

In (TBD) of (TBD), there is a possible out of bounds write due to a missing bounds check. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.

CVE-2021-39649 Dec 15, 19:15 MEDIUM PATCH This Month

In regmap_exit of regmap.c, there is a possible use-after-free due to improper locking. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity.

CVE-2021-39648 Dec 15, 19:15 MEDIUM PATCH This Month

In gadget_dev_desc_UDC_show of configfs.c, there is a possible disclosure of kernel heap memory due to a race condition. Rated medium severity (CVSS 4.1).

CVE-2021-39647 Dec 15, 19:15 MEDIUM PATCH This Month

In mon_smc_load_sp of gs101-sc/plat/samsung/exynos/soc/exynos9845/smc_booting.S, there is a possible reinitialization of TEE due to improper locking. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity.

CVE-2021-39646 Dec 15, 19:15 HIGH PATCH This Week

Product: AndroidVersions: Android kernelAndroid ID: A-201537251References: N/A. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2021-39645 Dec 15, 19:15 CRITICAL PATCH Act Now

Product: AndroidVersions: Android kernelAndroid ID: A-199805112References: N/A. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2021-39644 Dec 15, 19:15 CRITICAL PATCH Act Now

Product: AndroidVersions: Android kernelAndroid ID: A-199809304References: N/A. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2021-39643 Dec 15, 19:15 MEDIUM PATCH This Month

In ic_startRetrieveEntryValue of acropora/app/identity/ic.c, there is a possible bypass of defense-in-depth due to missing validation of the return value. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity.

CVE-2021-39642 Dec 15, 19:15 MEDIUM PATCH This Month

In synchronous_process_io_entries of lwis_ioctl.c, there is a possible out of bounds write due to a race condition. Rated medium severity (CVSS 6.4).

CVE-2021-39641 Dec 15, 19:15 CRITICAL PATCH Act Now

Product: AndroidVersions: Android kernelAndroid ID: A-126949257References: N/A. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2021-39640 Dec 15, 19:15 HIGH PATCH This Week

In __dwc3_gadget_ep0_queue of ep0.c, there is a possible out of bounds write due to improper locking. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.

CVE-2021-39639 Dec 15, 19:15 MEDIUM PATCH This Month

In TBD of fvp.c, there is a possible way to glitch CPU behavior due to a missing permission check. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.

CVE-2021-39638 Dec 15, 19:15 MEDIUM PATCH This Month

In periodic_io_work_func of lwis_periodic_io.c, there is a possible out of bounds write due to a use after free. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity.

CVE-2021-39637 Dec 15, 19:15 MEDIUM PATCH This Month

In CreateDeviceInfo of trusty_remote_provisioning_context.cpp, there is a possible out of bounds read due to a missing bounds check. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.

CVE-2021-39636 Dec 15, 19:15 MEDIUM PATCH This Month

In do_ipt_get_ctl and do_ipt_set_ctl of ip_tables.c, there is a possible way to leak kernel information due to uninitialized data. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity.

CVE-2021-1047 Dec 15, 19:15 MEDIUM PATCH This Month

In valid_ipc_dram_addr of cm_access_control.c, there is a possible out of bounds read due to an integer overflow. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity.

CVE-2021-1046 Dec 15, 19:15 MEDIUM PATCH This Month

In lwis_dpm_update_clock of lwis_device_dpm.c, there is a possible out of bounds read due to an incorrect bounds check. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.

CVE-2021-1045 Dec 15, 19:15 HIGH PATCH This Week

Product: AndroidVersions: Android kernelAndroid ID: A-195580473References: N/A. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2021-1044 Dec 15, 19:15 HIGH PATCH This Week

In eicOpsDecryptAes128Gcm of acropora/app/identity/identity_support.c, there is a possible out of bounds write due to a missing bounds check. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.

CVE-2021-1043 Dec 15, 19:15 MEDIUM PATCH This Month

In TBD of TBD, there is a possible downgrade attack due to under utilized anti-rollback protections. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.

CVE-2021-1042 Dec 15, 19:15 MEDIUM PATCH This Month

In dsi_panel_debugfs_read_cmdset of dsi_panel.c, there is a possible disclosure of freed kernel heap memory due to a use after free. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity.

CVE-2021-1041 Dec 15, 19:15 MEDIUM PATCH This Month

In (TBD) of (TBD), there is a possible out of bounds read due to memory corruption. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.

CVE-2021-1040 Dec 15, 19:15 HIGH PATCH This Week

In onCreate of BluetoothPairingSelectionFragment.java, there is a possible EoP due to a tapjacking/overlay attack. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.

CVE-2021-1039 Dec 15, 19:15 HIGH PATCH This Week

In NotificationAccessActivity of AndroidManifest.xml, there is a possible EoP due to a tapjacking/overlay attack. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.

CVE-2021-1038 Dec 15, 19:15 MEDIUM This Month

In UserDetailsActivity of AndroidManifest.xml, there is a possible DoS due to a tapjacking/overlay attack. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2021-1034 Dec 15, 19:15 LOW PATCH Monitor

In getLine1NumberForDisplay of PhoneInterfaceManager.java, there is apossible way to determine whether an app is installed, without querypermissions due to a missing permission check. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.

CVE-2021-1032 Dec 15, 19:15 LOW PATCH Monitor

In getMimeGroup of PackageManagerService.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity.

CVE-2021-1031 Dec 15, 19:15 LOW PATCH Monitor

In cancelNotificationsFromListener of NotificationManagerService.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity.

CVE-2021-1030 Dec 15, 19:15 MEDIUM This Month

In setNotificationsShownFromListener of NotificationManagerService.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.

CVE-2021-1029 Dec 15, 19:15 HIGH This Week

In setClientStateLocked of SurfaceFlinger.cpp, there is a possible out of bounds write due to a use after free. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.

CVE-2021-1028 Dec 15, 19:15 HIGH This Week

In setClientStateLocked of SurfaceFlinger.cpp, there is a possible out of bounds write due to a use after free. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.

CVE-2021-1027 Dec 15, 19:15 HIGH This Week

In setTransactionState of SurfaceFlinger, there is possible arbitrary code execution in a privileged process due to improper casting. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.

CVE-2021-1026 Dec 15, 19:15 MEDIUM This Month

In startRanging of RttServiceImpl.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.

CVE-2021-1025 Dec 15, 19:15 MEDIUM This Month

In hasNamedWallpaper of WallpaperManagerService.java, there is a possible way to determine whether an app is installed, without query permissions, due to a missing permission check. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.

CVE-2021-1024 Dec 15, 19:15 MEDIUM This Month

In onEventReceived of EventResultPersister.java, there is a possible intent redirection due to a confused deputy. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.

CVE-2021-1023 Dec 15, 19:15 MEDIUM This Month

In onCreate of RequestIgnoreBatteryOptimizations.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Rated medium severity (CVSS 5.0), this vulnerability is low attack complexity. No vendor patch available.

CVE-2021-1022 Dec 15, 19:15 HIGH This Week

In btif_in_hf_client_generic_evt of btif_hf_client.cc, there is a possible Bluetooth service crash due to a missing null check. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2021-1021 Dec 15, 19:15 HIGH This Week

In snoozeNotificationInt of NotificationManagerService.java, there is a possible way to disable notification for an arbitrary user due to improper input validation. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. No vendor patch available.

CVE-2021-1020 Dec 15, 19:15 HIGH This Week

In snoozeNotification of NotificationListenerService.java, there is a possible way to disable notification for an arbitrary user due to improper input validation. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. No vendor patch available.

CVE-2021-1019 Dec 15, 19:15 HIGH This Week

In snoozeNotification of NotificationListenerService.java, there is a possible permission confusion due to a misleading user consent dialog. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. No vendor patch available.

CVE-2021-1018 Dec 15, 19:15 LOW Monitor

In adjustStreamVolume of AudioService.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. No vendor patch available.

CVE-2021-1017 Dec 15, 19:15 HIGH This Week

In AdapterService and GattService definition of AndroidManifest.xml, there is a possible way to disable bluetooth connection due to a missing permission check. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2021-1016 Dec 15, 19:15 HIGH This Week

In onCreate of UsbPermissionActivity.java, there is a possible way to grant an app access to USB without informed user consent due to a tapjacking/overlay attack. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. No vendor patch available.

CVE-2021-1015 Dec 15, 19:15 LOW Monitor

In getMeidForSlot of PhoneInterfaceManager.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. No vendor patch available.

CVE-2021-1014 Dec 15, 19:15 MEDIUM This Month

In getNetworkTypeForSubscriber of PhoneInterfaceManager.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.

CVE-2021-1013 Dec 15, 19:15 MEDIUM This Month

In checkExistsAndEnforceCannotModifyImmutablyRestrictedPermission of PermissionManagerService.java, there is a possible way to determine whether an app is installed, without query permissions, due to. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.

CVE-2021-1012 Dec 15, 19:15 MEDIUM This Month

In onResume of NotificationAccessDetails.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.

CVE-2021-1011 Dec 15, 19:15 MEDIUM This Month

In setPackageStoppedState of PackageManagerService.java, there is a missing permission check. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.

CVE-2021-1010 Dec 15, 19:15 MEDIUM This Month

In getSigningKeySet of PackageManagerService.java, there is a missing permission check. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.

CVE-2021-1009 Dec 15, 19:15 MEDIUM This Month

In setApplicationCategoryHint of PackageManagerService.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.

CVE-2021-1008 Dec 15, 19:15 MEDIUM This Month

In addSubInfo of SubscriptionController.java, there is a possible way to force the user to make a factory reset due to a logic error in the code. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. No vendor patch available.

CVE-2021-1007 Dec 15, 19:15 MEDIUM This Month

In btu_hcif_process_event of btu_hcif.cc, there is a possible out of bounds read due to an incorrect bounds check. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. No vendor patch available.

CVE-2021-1006 Dec 15, 19:15 MEDIUM This Month

In several functions of DatabaseManager.java, there is a possible leak of Bluetooth MAC addresses due to log information disclosure. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. No vendor patch available.

CVE-2021-1005 Dec 15, 19:15 MEDIUM This Month

In getDeviceIdWithFeature of PhoneInterfaceManager.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.

CVE-2021-1004 Dec 15, 19:15 HIGH This Week

In getConfiguredNetworks of WifiServiceImpl.java, there is a possible way to determine whether an app is installed, without query permissions, due to a missing permission check. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.

CVE-2021-1003 Dec 15, 19:15 HIGH This Week

In adjustStreamVolume of AudioService.java, there is a possible way for unprivileged app to change audio stream volume due to a confused deputy. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.

CVE-2021-1002 Dec 15, 19:15 HIGH This Week

In WT_Interpolate of eas_wtengine.c, there is a possible out of bounds read due to a missing bounds check. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2021-1001 Dec 15, 19:15 MEDIUM This Month

In PVInitVideoEncoder of mp4enc_api.cpp, there is a possible out of bounds read due to a heap buffer overflow. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.

CVE-2021-0999 Dec 15, 19:15 HIGH PATCH This Week

In the broadcast definition in AndroidManifest.xml, there is a possible way to set the A2DP bluetooth device connection state due to a missing permission check. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.

CVE-2021-0998 Dec 15, 19:15 MEDIUM PATCH This Month

In 'ih264e_find_bskip_params()' of ih264e_me.c, there is a possible out of bounds read due to a heap buffer overflow. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.

CVE-2021-0997 Dec 15, 19:15 MEDIUM PATCH This Month

In handleUpdateNetworkState of GnssNetworkConnectivityHandler.java , there is a possible APN disclosure due to log information disclosure. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.

CVE-2021-0996 Dec 15, 19:15 MEDIUM PATCH This Month

In nfaHciCallback of HciEventManager.cpp, there is a possible out of bounds read due to a missing bounds check. Rated medium severity (CVSS 4.5), this vulnerability is low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.

CVE-2021-0995 Dec 15, 19:15 LOW PATCH Monitor

In registerSuggestionConnectionStatusListener of WifiServiceImpl.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity.

CVE-2021-0994 Dec 15, 19:15 LOW PATCH Monitor

In requestRouteToHostAddress of ConnectivityService.java, there is a possible way to determine whether an app is installed, without query permissions, due to a missing permission check. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.

CVE-2021-0993 Dec 15, 19:15 MEDIUM PATCH This Month

In getOffsetBeforeAfter of TextLine.java, there is a possible denial of service due to resource exhaustion. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2021-0992 Dec 15, 19:15 LOW PATCH Monitor

In onCreate of PaymentDefaultDialog.java, there is a possible way to change a default payment app without user consent due to tapjack overlay. Rated low severity (CVSS 3.3), this vulnerability is no authentication required, low attack complexity.

CVE-2021-0991 Dec 15, 19:15 LOW PATCH Monitor

In OnMetadataChangedListener of AdvancedBluetoothDetailsHeaderController.java, there is a possible leak of Bluetooth MAC addresses due to log information disclosure. Rated low severity (CVSS 2.4), this vulnerability is low attack complexity.

CVE-2021-0990 Dec 15, 19:15 LOW PATCH Monitor

In getDeviceId of PhoneSubInfoController.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity.

CVE-2021-0989 Dec 15, 19:15 LOW PATCH Monitor

In hasManageOngoingCallsPermission of TelecomServiceImpl.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity.

CVE-2021-0988 Dec 15, 19:15 LOW PATCH Monitor

In getLaunchedFromUid and getLaunchedFromPackage of ActivityClientController.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity.

CVE-2021-0987 Dec 15, 19:15 LOW PATCH Monitor

In getNeighboringCellInfo of PhoneInterfaceManager.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity.

CVE-2021-0986 Dec 15, 19:15 MEDIUM PATCH This Month

In hasGrantedPolicy of DevicePolicyManagerService.java, there is a possible information disclosure about the device owner, profile owner, or device admin due to a logic error in the code. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.

CVE-2021-0985 Dec 15, 19:15 HIGH PATCH This Week

In onReceive of AlertReceiver.java, there is a possible way to dismiss system dialog due to a missing permission check. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.

CVE-2021-0984 Dec 15, 19:15 HIGH PATCH This Week

In onNullBinding of ManagedServices.java, there is a possible permission bypass due to an incorrectly unbound service. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.

CVE-2021-0983 Dec 15, 19:15 LOW Monitor

In createAdminSupportIntent of DevicePolicyManagerService.java, there is a possible disclosure of information about installed device/profile owner package name due to side channel information. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. No vendor patch available.

CVE-2021-0982 Dec 15, 19:15 LOW PATCH Monitor

In getOrganizationNameForUser of DevicePolicyManagerService.java, there is a possible organization name disclosure due to a missing permission check. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.

CVE-2021-0981 Dec 15, 19:15 HIGH PATCH This Week

In enqueueNotificationInternal of NotificationManagerService.java, there is a possible way to run a foreground service without showing a notification due to improper input validation. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.

CVE-2021-0979 Dec 15, 19:15 MEDIUM PATCH This Month

In isRequestPinItemSupported of ShortcutService.java, there is a possible cross-user leak of packages in which the default launcher supports requests to create pinned shortcuts due to a permissions. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. This Incorrect Default Permissions vulnerability could allow attackers to access resources due to overly permissive default settings.

CVE-2021-0978 Dec 15, 19:15 LOW PATCH Monitor

In getSerialForPackage of DeviceIdentifiersPolicyService.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.

CVE-2021-0977 Dec 15, 19:15 MEDIUM PATCH This Month

In phNxpNHal_DtaUpdate of phNxpNciHal_dta.cc, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.

CVE-2021-0976 Dec 15, 19:15 MEDIUM PATCH This Month

In toBARK of floor0.c, there is a possible out of bounds read due to a missing bounds check. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.