alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2022-20051 (published 2022-03-10)
In ims service, there is a possible unexpected application behavior due to incorrect privilege assignment. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06219127; Issue ID: ALPS06219127.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-269
Affected vendors: google, mediatek
Affected products: android, mt6731, mt6732, mt6735, mt6737, mt6739, mt6750, mt6750s, mt6752, mt6753, mt6755, mt6755s, mt6757, mt6757c, mt6757cd, mt6757ch, mt6758, mt6761, mt6762, mt6763, mt6765, mt6768, mt6769, mt6771, mt6779
CVE-2022-20052 (published 2022-04-11)
In mdp, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS05836642; Issue ID: ALPS05836642.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: google, mediatek
Affected products: android, mt6580, mt6735, mt6737, mt6739, mt6750, mt6753, mt6755, mt6762, mt6763, mt6765, mt6768, mt6769, mt6771, mt6779, mt6781, mt6785, mt6833, mt6853, mt6853t, mt6873, mt6877, mt6885, mt6890, mt6891
CVE-2022-20053 (published 2022-03-10)
In ims service, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06219097; Issue ID: ALPS06219097.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-862
Affected vendors: google, mediatek
Affected products: android, mt6731, mt6732, mt6735, mt6737, mt6739, mt6750, mt6750s, mt6752, mt6753, mt6755, mt6755s, mt6757, mt6758, mt6761, mt6762, mt6763, mt6765, mt6768, mt6769, mt6771, mt6779, mt6781, mt6785, mt6795
CVE-2022-20054 (published 2022-03-10)
In ims service, there is a possible AT command injection due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06219083; Issue ID: ALPS06219083.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-862
Affected vendors: google, mediatek
Affected products: android, mt6580, mt6739, mt6750, mt6761, mt6762, mt6763, mt6765, mt6768, mt6771, mt6779, mt8167, mt8168, mt8173, mt8183, mt8185, mt8321, mt8362a, mt8365, mt8385, mt8666, mt8667, mt8675, mt8765, mt8766
CVE-2022-20055 (published 2022-03-10)
In preloader (usb), there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, for an attacker who has physical access to the device, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS06160806; Issue ID: ALPS06160830.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: google, mediatek
Affected products: android, mt6761, mt6762, mt6765, mt6768, mt6771, mt6779, mt6781, mt6785, mt6833, mt6853, mt6853t, mt6873, mt6877, mt6885, mt6893, mt8183, mt8185, mt8321, mt8385, mt8666, mt8667, mt8675, mt8735a, mt8735b
CVE-2022-20056 (published 2022-03-10)
In preloader (usb), there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, for an attacker who has physical access to the device, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS06160806; Issue ID: ALPS06160820.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: google, mediatek
Affected products: android, mt6761, mt6762, mt6765, mt6768, mt6771, mt6779, mt6781, mt6785, mt6833, mt6853, mt6853t, mt6873, mt6877, mt6885, mt6893, mt8183, mt8185, mt8321, mt8385, mt8666, mt8667, mt8675, mt8735a, mt8735b
CVE-2022-20057 (published 2022-03-10)
In btif, there is a possible memory corruption due to incorrect error handling. This could lead to local escalation of privilege with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS06271186; Issue ID: ALPS06271186.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-755
Affected vendors: google, mediatek
Affected products: android, mt6739, mt6758, mt6761, mt6765, mt6768, mt6769, mt6771, mt6779, mt6781, mt6785, mt6833, mt6853, mt6853t, mt6873, mt6883, mt6893, mt8163, mt8167, mt8168, mt8173, mt8362a, mt8365
CVE-2022-20058 (published 2022-03-10)
In preloader (usb), there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, for an attacker who has physical access to the device, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS06160806; Issue ID: ALPS06160485.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: google, mediatek
Affected products: android, mt6761, mt6762, mt6765, mt6768, mt6771, mt6779, mt6781, mt6785, mt6833, mt6853, mt6853t, mt6873, mt6877, mt6885, mt6893, mt8183, mt8185, mt8321, mt8385, mt8666, mt8667, mt8675, mt8735a, mt8735b
CVE-2022-20059 (published 2022-03-10)
In preloader (usb), there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, for an attacker who has physical access to the device, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS06160806; Issue ID: ALPS06160781.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: google, mediatek
Affected products: android, mt6761, mt6762, mt6765, mt6768, mt6771, mt6779, mt6781, mt6785, mt6833, mt6853, mt6853t, mt6873, mt6875, mt6877, mt6885, mt6889, mt6893, mt8183, mt8185, mt8321, mt8385, mt8666, mt8667, mt8675
CVE-2022-2006 (published 2022-08-31)
AutomationDirect DirectLOGIC has a DLL vulnerability in the install directory that may allow an attacker to execute code during the installation process. This issue affects: AutomationDirect C-more EA9 EA9-T6CL versions prior to 6.73; EA9-T6CL-R versions prior to 6.73; EA9-T7CL versions prior to 6.73; EA9-T7CL-R versions prior to 6.73; EA9-T8CL versions prior to 6.73; EA9-T10CL versions prior to 6.73; EA9-T10WCL versions prior to 6.73; EA9-T12CL versions prior to 6.73; EA9-T15CL versions prior to 6.73; EA9-RHMI versions prior to 6.73; EA9-PGMSW versions prior to 6.73;
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-427
Affected vendors: automationdirect
Affected products: c-more_ea9-pgmsw, c-more_ea9-pgmsw_firmware, c-more_ea9-rhmi, c-more_ea9-rhmi_firmware, c-more_ea9-t10cl, c-more_ea9-t10cl_firmware, c-more_ea9-t10wcl, c-more_ea9-t10wcl_firmware, c-more_ea9-t12cl, c-more_ea9-t12cl_firmware, c-more_ea9-t15cl, c-more_ea9-t15cl-r, c-more_ea9-t15cl-r_firmware, c-more_ea9-t15cl_firmware, c-more_ea9-t6cl, c-more_ea9-t6cl-r, c-more_ea9-t6cl-r_firmware, c-more_ea9-t6cl_firmware, c-more_ea9-t7cl, c-more_ea9-t7cl-r, c-more_ea9-t7cl-r_firmware, c-more_ea9-t7cl_firmware, c-more_ea9-t8cl, c-more_ea9-t8cl_firmware
CVE-2022-20060 (published 2022-03-10)
In preloader (usb), there is a possible permission bypass due to a missing proper image authentication. This could lead to local escalation of privilege, for an attacker who has physical access to the device, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS06160806; Issue ID: ALPS06137462.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-306
Affected vendors: google, mediatek
Affected products: android, mt6761, mt6762, mt6765, mt6768, mt6771, mt6779, mt6781, mt6785, mt6833, mt6853, mt6873, mt6875, mt6877, mt6885, mt6889, mt6893, mt8183, mt8185, mt8321, mt8385, mt8666, mt8667, mt8675, mt8735a
CVE-2022-20062 (published 2022-04-11)
In mdp, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is no needed for exploitation. Patch ID: ALPS05836418; Issue ID: ALPS05836418.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: google, mediatek
Affected products: android, mt6765, mt6785, mt6833, mt6853, mt6853t, mt6873, mt6877, mt6879, mt6885, mt6891, mt6893, mt8163, mt8167, mt8167s, mt8168, mt8173, mt8175, mt8183, mt8185, mt8321, mt8362a, mt8365, mt8385, mt8666
CVE-2022-20063 (published 2022-04-11)
In atf (spm), there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS06171715; Issue ID: ALPS06171715.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: google, mediatek
Affected products: android, mt6765, mt8385, mt8666, mt8667, mt8766, mt8786, mt8788
CVE-2022-20064 (published 2022-04-11)
In ccci, there is a possible leak of kernel pointer due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06108617; Issue ID: ALPS06108617.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-125
Affected vendors: google, mediatek
Affected products: android, mt6580, mt6737, mt6739, mt6761, mt6762, mt6763, mt6765, mt6768, mt6769, mt6779, mt6781, mt6785, mt6789, mt6833, mt6853, mt6873, mt6875, mt6877, mt6879, mt6883, mt6885, mt6889, mt6893, mt6895
CVE-2022-20065 (published 2022-04-11)
In ccci, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06108658; Issue ID: ALPS06108658.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-125
Affected vendors: google, mediatek
Affected products: android, mt6580, mt6737, mt6739, mt6761, mt6762, mt6765, mt6768, mt6769, mt6779, mt6781, mt6785, mt6833, mt6873, mt6875, mt6877, mt6883, mt6885, mt6889, mt6983, mt8321, mt8667, mt8675, mt8765, mt8766
CVE-2022-20066 (published 2022-04-11)
In atf (hwfde), there is a possible leak of sensitive information due to incorrect error handling. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06171729; Issue ID: ALPS06171729.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-755
Affected vendors: google, mediatek
Affected products: android, mt6580, mt6739, mt6761, mt6765, mt6769, mt6771, mt6785, mt6833, mt6873, mt6875, mt6877, mt6891, mt8168, mt8365, mt8666, mt8667, mt8696, mt8766, mt8768, mt8788
CVE-2022-20067 (published 2022-04-11)
In mdp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is no needed for exploitation. Patch ID: ALPS05836585; Issue ID: ALPS05836585.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: google, mediatek
Affected products: android, mt6731, mt6735, mt6739, mt6750, mt6755, mt6755s, mt6757, mt6761, mt6762, mt6763, mt6765, mt6768, mt6769, mt6771, mt6779, mt6785, mt6833, mt6853, mt6853t, mt6873, mt6885, mt6891, mt6893, mt8167
CVE-2022-20068 (published 2022-04-11)
In mobile_log_d, there is a possible symbolic link following due to an improper link resolution. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06308907; Issue ID: ALPS06308907.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-59
Affected vendors: google, mediatek
Affected products: android, mt6731, mt6732, mt6735, mt6737, mt6739, mt6761, mt6762, mt6763, mt6765, mt6768, mt6769, mt6771, mt6779, mt6781, mt6785, mt6795, mt6799, mt6833, mt6853t, mt6873, mt6875, mt6877, mt6880, mt6883
CVE-2022-20069 (published 2022-04-11)
In preloader (usb), there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege, for an attacker who has physical access to the device, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS06160425; Issue ID: ALPS06160425.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-190
Affected vendors: google, mediatek
Affected products: android, mt6580, mt6735, mt6739, mt6761, mt6762, mt6763, mt6765, mt6768, mt6769, mt6771, mt6779, mt6781, mt6785, mt6799, mt6833, mt6853, mt6853t, mt6873, mt6877, mt6885, mt6893, mt6983, mt8167, mt8167s
CVE-2022-2007 (published 2022-07-28)
Use after free in WebGPU in Google Chrome prior to 102.0.5005.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: fedoraproject, google
Affected products: chrome, fedora
CVE-2022-20070 (published 2022-04-11)
In ssmr, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is no needed for exploitation. Patch ID: ALPS06362920; Issue ID: ALPS06362920.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: google, mediatek
Affected products: android, mt6731, mt6732, mt6735, mt6737, mt6739, mt6750, mt6750s, mt6752, mt6753, mt6755, mt6755s, mt6757, mt6757c, mt6757cd, mt6757ch, mt6758, mt6761, mt6762, mt6763, mt6765, mt6768, mt6769, mt6771, mt6779
CVE-2022-20071 (published 2022-04-11)
In ccu, there is a possible escalation of privilege due to a missing certificate validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is no needed for exploitation. Patch ID: ALPS06183315; Issue ID: ALPS06183315.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-295
Affected vendors: google, mediatek
Affected products: android, mt6833, mt6853, mt6873, mt6877, mt6885, mt6893, mt8797
CVE-2022-20072 (published 2022-04-11)
In search engine service, there is a possible way to change the default search engine due to an incorrect comparison. This could lead to local escalation of privilege with System execution privileges needed. User interaction is no needed for exploitation. Patch ID: ALPS06219118; Issue ID: ALPS06219118.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-697
Affected vendors: google, mediatek
Affected products: android, mt6580, mt6735, mt6737, mt6739, mt6753, mt6755, mt6755s, mt6761, mt6765, mt6768, mt6769, mt6771, mt6779, mt6781, mt6785, mt6789, mt6795, mt6797, mt6799, mt6833, mt6853, mt6853t, mt6873, mt6875
CVE-2022-20073 (published 2022-04-11)
In preloader (usb), there is a possible out of bounds write due to a integer underflow. This could lead to local escalation of privilege, for an attacker who has physical access to the device, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS06160841; Issue ID: ALPS06160841.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-191
Affected vendors: google, mediatek
Affected products: android, mt2601, mt6580, mt6735, mt6739, mt6761, mt6763, mt6765, mt6768, mt6771, mt6779, mt6781, mt6785, mt6799, mt6833, mt6873, mt6877, mt6885, mt6893, mt8163, mt8167, mt8167s, mt8168, mt8173, mt8175
CVE-2022-20074 (published 2022-04-11)
In preloader (partition), there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, for an attacker who has physical access to the device, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS06183301; Issue ID: ALPS06183301.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-125
Affected vendors: google, mediatek
Affected products: android, mt6761, mt6762, mt6763, mt6765, mt6768, mt6769, mt6779, mt6833, mt6853, mt6853t, mt6873, mt6875, mt6877, mt6879, mt6880, mt6883, mt6885, mt6889, mt6890, mt6891, mt6893, mt6895, mt6983, mt6985
CVE-2022-20075 (published 2022-04-11)
In ged, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05838808; Issue ID: ALPS05838808.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-190
Affected vendors: google, mediatek
Affected products: android, mt6580, mt6731, mt6735, mt6750s, mt6753, mt6755s, mt6757, mt6757c, mt6757cd, mt6757ch, mt6761, mt6762, mt6763, mt6765, mt6768, mt6769, mt6771, mt6779, mt6781, mt6785, mt6833, mt6853, mt6853t, mt6873
CVE-2022-20076 (published 2022-04-11)
In ged, there is a possible memory corruption due to an incorrect error handling. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05838808; Issue ID: ALPS05839556.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-755
Affected vendors: google, mediatek
Affected products: android, mt6580, mt6731, mt6735, mt6750s, mt6753, mt6755s, mt6757, mt6757c, mt6757cd, mt6757ch, mt6761, mt6762, mt6763, mt6765, mt6768, mt6769, mt6771, mt6779, mt6781, mt6785, mt6833, mt6853, mt6853t, mt6873
CVE-2022-20077 (published 2022-04-11)
In vow, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is no needed for exploitation. Patch ID: ALPS05837742; Issue ID: ALPS05852812.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-362
Affected vendors: google, mediatek
Affected products: android, mt6781, mt6785, mt6833, mt6853, mt6853t, mt6873, mt6877, mt6883, mt6885, mt6889, mt6891, mt6893, mt8185, mt8789, mt8791, mt8797
CVE-2022-20078 (published 2022-04-11)
In vow, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is no needed for exploitation. Patch ID: ALPS05852819; Issue ID: ALPS05852819.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-362
Affected vendors: google, mediatek
Affected products: android, mt6833, mt6853, mt6853t, mt6873, mt6877, mt6883, mt6885, mt6889, mt6891, mt6893, mt8791, mt8797
CVE-2022-20079 (published 2022-04-11)
In vow, there is a possible read of uninitialized data due to a improper input validation. This could lead to local information disclosure with System execution privileges needed. User interaction is no needed for exploitation. Patch ID: ALPS05837742; Issue ID: ALPS05857289.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-908
Affected vendors: google, mediatek
Affected products: android, mt6781, mt6785, mt6833, mt6853, mt6853t, mt6873, mt6877, mt6883, mt6885, mt6889, mt6891, mt6893, mt8185, mt8789, mt8791, mt8797
CVE-2022-2008 (published 2022-07-28)
Double free in WebGL in Google Chrome prior to 102.0.5005.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-415
Affected vendors: fedoraproject, google
Affected products: chrome, fedora
CVE-2022-20080 (published 2022-04-11)
In SUB2AF, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is no needed for exploitation. Patch ID: ALPS05881290; Issue ID: ALPS05881290.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-362
Affected vendors: google, mediatek
Affected products: android, mt6580, mt6735, mt6737, mt6739, mt6753, mt6757, mt6761, mt6763, mt6765, mt6768, mt6771, mt6779, mt6781, mt6785, mt6833, mt6853, mt6873, mt6877, mt6883, mt6885, mt6889, mt6893, mt8168, mt8321
CVE-2022-20081 (published 2022-04-11)
In A-GPS, there is a possible man in the middle attack due to improper certificate validation. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06461919; Issue ID: ALPS06461919.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-295
Affected vendors: google, mediatek
Affected products: android, mt6580, mt6735, mt6737, mt6739, mt6753, mt6761, mt6765, mt6768, mt6771, mt6779, mt6781, mt6785, mt6833, mt6853, mt6873, mt6877, mt6879, mt6883, mt6885, mt6889, mt6893, mt6895, mt6983, mt8666
CVE-2022-20082 (published 2022-07-06)
In GPU, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07044730; Issue ID: ALPS07044730.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-362
Affected vendors: google, mediatek
Affected products: android, mt6768, mt6769, mt6781, mt6785, mt6789, mt6833, mt6853, mt6853t, mt6873, mt6875, mt6877, mt6879, mt6883, mt6885, mt6889, mt6893, mt6895, mt6983
CVE-2022-20083 (published 2022-07-06)
In Modem 2G/3G CC, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution when decoding combined FACILITY with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY00803883; Issue ID: MOLY00803883.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: mediatek
Affected products: lr11, lr12, lr12a, lr13, lr9, mt2731, mt2735, mt6297, mt6725, mt6735, mt6737, mt6739, mt6750, mt6750s, mt6755, mt6757, mt6757p, mt6758, mt6761, mt6762, mt6762d, mt6762m, mt6763, mt6765, mt6765t
CVE-2022-20084 (published 2022-05-03)
In telephony, there is a possible way to disable receiving emergency broadcasts due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06498874; Issue ID: ALPS06498874.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-862
Affected vendors: google, mediatek
Affected products: android, mt6731, mt6732, mt6735, mt6737, mt6739, mt6750, mt6750s, mt6752, mt6753, mt6755, mt6755s, mt6757, mt6757c, mt6757cd, mt6757ch, mt6758, mt6761, mt6762, mt6763, mt6768, mt6771, mt6779, mt6781, mt6785
CVE-2022-20085 (published 2022-05-03)
In netdiag, there is a possible symbolic link following due to an improper link resolution. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06308877; Issue ID: ALPS06308877.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-59
Affected vendors: google, mediatek
Affected products: android, mt6580, mt6731, mt6735, mt6750s, mt6753, mt6755s, mt6757, mt6757c, mt6757cd, mt6757ch, mt6761, mt6762, mt6763, mt6765, mt6768, mt6769, mt6771, mt6779, mt6781, mt6785, mt6833, mt6853, mt6853t, mt6873
CVE-2022-20087 (published 2022-05-03)
In ccu, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06477970; Issue ID: ALPS06477970.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: google, mediatek
Affected products: android, mt6833, mt6853, mt6873, mt6877, mt6885, mt6893
CVE-2022-20088 (published 2022-05-03)
In aee driver, there is a possible reference count mistake due to incorrect error handling. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06209201; Issue ID: ALPS06209201.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-755
Affected vendors: google, mediatek
Affected products: android, mt6580, mt6731, mt6739, mt6761, mt6762, mt6765, mt6768, mt6769, mt6771, mt6779, mt6781, mt6785, mt6833, mt6853, mt6853t, mt6873, mt6875, mt6877, mt6879, mt6883, mt6885, mt6889, mt6891, mt6893
CVE-2022-20089 (published 2022-05-03)
In aee driver, there is a possible memory corruption due to active debug code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06240397; Issue ID: ALPS06240397.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: google, mediatek
Affected products: android, mt6580, mt6731, mt6739, mt6761, mt6762, mt6765, mt6768, mt6769, mt6771, mt6779, mt6781, mt6785, mt6833, mt6853, mt6853t, mt6873, mt6875, mt6877, mt6879, mt6883, mt6885, mt6889, mt6891, mt6893
CVE-2022-20090 (published 2022-05-03)
In aee driver, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06209197; Issue ID: ALPS06209197.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-362
Affected vendors: google, mediatek
Affected products: android, mt6580, mt6731, mt6739, mt6761, mt6762, mt6765, mt6768, mt6769, mt6771, mt6779, mt6781, mt6785, mt6833, mt6853, mt6853t, mt6873, mt6875, mt6877, mt6879, mt6883, mt6885, mt6889, mt6891, mt6893
CVE-2022-20091 (published 2022-05-03)
In aee driver, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06209201; Issue ID: ALPS06226345.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-362
Affected vendors: google, mediatek
Affected products: android, mt6580, mt6731, mt6739, mt6761, mt6762, mt6765, mt6768, mt6769, mt6771, mt6779, mt6781, mt6785, mt6833, mt6853, mt6853t, mt6873, mt6875, mt6877, mt6879, mt6883, mt6885, mt6889, mt6891, mt6893
CVE-2022-20092 (published 2022-05-03)
In alac decoder, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06366061; Issue ID: ALPS06366061.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-125
Affected vendors: google, mediatek
Affected products: android, mt6761, mt6768, mt6779, mt6785, mt6833, mt6853, mt6853t, mt6873, mt6877, mt6879, mt6883, mt6885, mt6889, mt6893, mt6895, mt6983, mt8173, mt8175, mt8183, mt8185, mt8385, mt8791, mt8797
CVE-2022-20093 (published 2022-05-03)
In telephony, there is a possible way to disable receiving SMS messages due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06498868; Issue ID: ALPS06498868.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-862
Affected vendors: google, mediatek
Affected products: android, mt6731, mt6732, mt6735, mt6737, mt6739, mt6750, mt6750s, mt6752, mt6753, mt6755, mt6755s, mt6757, mt6757c, mt6757cd, mt6757ch, mt6758, mt6761, mt6762, mt6763, mt6765, mt6768, mt6769, mt6771, mt6779
CVE-2022-20094 (published 2022-05-03)
In imgsensor, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06479763; Issue ID: ALPS06479734.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: google, mediatek
Affected products: android, mt6771, mt6779, mt6781, mt6785, mt6833, mt6853, mt6873, mt6885, mt6893, mt8788, mt8797
CVE-2022-20095 (published 2022-05-03)
In imgsensor, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06479763; Issue ID: ALPS06479763.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: google, mediatek
Affected products: android, mt6771, mt6779, mt6781, mt6785, mt6833, mt6853, mt6873, mt6885, mt6893, mt8788, mt8797
CVE-2022-20096 (published 2022-05-03)
In camera, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with System execution privileges needed. User interaction is no needed for exploitation. Patch ID: ALPS06419003; Issue ID: ALPS06419003.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-908
Affected vendors: google, mediatek
Affected products: android, mt6765, mt6768, mt6769, mt8183, mt8185, mt8385, mt8666, mt8667, mt8768, mt8786, mt8788, mt8789
CVE-2022-20097 (published 2022-05-03)
In aee daemon, there is a possible information disclosure due to a race condition. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06383944; Issue ID: ALPS06383944.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-362
Affected vendors: google, mediatek
Affected products: android, mt6580, mt6739, mt6761, mt6762, mt6765, mt6768, mt6769, mt6771, mt6779, mt6781, mt6785, mt6789, mt6833, mt6853, mt6853t, mt6873, mt6875, mt6877, mt6879, mt6883, mt6885, mt6889, mt6891, mt6893
CVE-2022-20098 (published 2022-05-03)
In aee daemon, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06419017; Issue ID: ALPS06419017.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-862
Affected vendors: google, mediatek
Affected products: android, mt6580, mt6739, mt6761, mt6762, mt6765, mt6768, mt6769, mt6771, mt6779, mt6781, mt6785, mt6789, mt6833, mt6853, mt6853t, mt6873, mt6875, mt6877, mt6879, mt6883, mt6885, mt6889, mt6891, mt6893
CVE-2022-20099 (published 2022-05-03)
In aee daemon, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06296442; Issue ID: ALPS06296442.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: google, mediatek
Affected products: android, mt6580, mt6739, mt6761, mt6762, mt6765, mt6768, mt6769, mt6771, mt6779, mt6781, mt6785, mt6789, mt6833, mt6853, mt6853t, mt6873, mt6875, mt6877, mt6879, mt6883, mt6885, mt6889, mt6891, mt6893
CVE-2022-2010 (published 2022-07-28)
Out of bounds read in compositing in Google Chrome prior to 102.0.5005.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:H)
Weakness: CWE-125
Affected vendors: fedoraproject, google
Affected products: chrome, fedora
CVE-2022-20100 (published 2022-05-03)
In aee daemon, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06383944; Issue ID: ALPS06270804.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-862
Affected vendors: google, mediatek
Affected products: android, mt6580, mt6739, mt6761, mt6762, mt6765, mt6768, mt6769, mt6771, mt6779, mt6781, mt6785, mt6789, mt6833, mt6853, mt6853t, mt6873, mt6875, mt6877, mt6879, mt6883, mt6885, mt6889, mt6891, mt6893
CVE-2022-20101 (published 2022-05-03)
In aee daemon, there is a possible information disclosure due to a path traversal. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06419017; Issue ID: ALPS06270870.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-22
Affected vendors: google, mediatek
Affected products: android, mt6580, mt6739, mt6761, mt6762, mt6765, mt6768, mt6769, mt6771, mt6779, mt6781, mt6785, mt6789, mt6833, mt6853, mt6853t, mt6873, mt6875, mt6877, mt6879, mt6883, mt6885, mt6889, mt6891, mt6893
CVE-2022-20102 (published 2022-05-03)
In aee daemon, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06296442; Issue ID: ALPS06296405.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-862
Affected vendors: google, mediatek
Affected products: android, mt6580, mt6739, mt6761, mt6762, mt6765, mt6768, mt6769, mt6771, mt6779, mt6781, mt6785, mt6789, mt6833, mt6853, mt6853t, mt6873, mt6875, mt6877, mt6879, mt6883, mt6885, mt6889, mt6891, mt6893
CVE-2022-20103 (published 2022-05-03)
In aee daemon, there is a possible information disclosure due to symbolic link following. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06383944; Issue ID: ALPS06282684.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-59
Affected vendors: google, mediatek
Affected products: android, mt6580, mt6739, mt6761, mt6762, mt6765, mt6768, mt6769, mt6771, mt6779, mt6781, mt6785, mt6789, mt6833, mt6853, mt6853t, mt6873, mt6875, mt6877, mt6879, mt6883, mt6885, mt6889, mt6891, mt6893
CVE-2022-20104 (published 2022-05-03)
In aee daemon, there is a possible information disclosure due to improper access control. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06419017; Issue ID: ALPS06284104.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: google, mediatek
Affected products: android, mt6580, mt6739, mt6761, mt6762, mt6765, mt6768, mt6769, mt6771, mt6779, mt6781, mt6785, mt6789, mt6833, mt6853, mt6853t, mt6873, mt6875, mt6877, mt6879, mt6883, mt6885, mt6889, mt6891, mt6893
CVE-2022-20105 (published 2022-05-03)
In MM service, there is a possible out of bounds write due to a stack-based buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: DTV03330460; Issue ID: DTV03330460.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: google, linux, mediatek
Affected products: android, linux_kernel, mt9011, mt9215, mt9216, mt9220, mt9221, mt9255, mt9256, mt9266, mt9269, mt9285, mt9286, mt9288, mt9600, mt9602, mt9610, mt9611, mt9612, mt9613, mt9615, mt9617, mt9629, mt9630, mt9631
CVE-2022-20106 (published 2022-05-03)
In MM service, there is a possible out of bounds write due to a heap-based buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: DTV03330460; Issue ID: DTV03330460.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: google, linux, mediatek
Affected products: android, linux_kernel, mt9011, mt9215, mt9216, mt9220, mt9221, mt9255, mt9256, mt9266, mt9269, mt9285, mt9286, mt9288, mt9600, mt9602, mt9610, mt9611, mt9612, mt9613, mt9615, mt9617, mt9629, mt9630, mt9631
CVE-2022-20107 (published 2022-05-03)
In subtitle service, there is a possible application crash due to an integer overflow. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: DTV03330673; Issue ID: DTV03330673.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-190
Affected vendors: google, linux, mediatek
Affected products: android, linux_kernel, mt9011, mt9215, mt9216, mt9220, mt9221, mt9255, mt9256, mt9266, mt9269, mt9285, mt9286, mt9288, mt9600, mt9602, mt9610, mt9611, mt9612, mt9613, mt9615, mt9617, mt9629, mt9630, mt9631
CVE-2022-20108 (published 2022-05-03)
In voice service, there is a possible out of bounds write due to a stack-based buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: DTV03330702; Issue ID: DTV03330702.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: google, linux, mediatek
Affected products: android, linux_kernel, mt9011, mt9215, mt9216, mt9220, mt9221, mt9255, mt9256, mt9266, mt9269, mt9285, mt9286, mt9288, mt9600, mt9602, mt9610, mt9611, mt9612, mt9613, mt9615, mt9617, mt9629, mt9630, mt9631
CVE-2022-20109 (published 2022-05-03)
In ion, there is a possible use after free due to improper update of reference count. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06399915; Issue ID: ALPS06399915.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: google, mediatek
Affected products: android, mt6580, mt6735, mt6737, mt6739, mt6750, mt6750s, mt6753, mt6757, mt6757c, mt6757cd, mt6757ch, mt6761, mt6762, mt6763, mt6765, mt6768, mt6769, mt6771, mt6779, mt6781, mt6785, mt6797, mt6833, mt6853
CVE-2022-2011 (published 2022-07-28)
Use after free in ANGLE in Google Chrome prior to 102.0.5005.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: fedoraproject, google
Affected products: chrome, fedora
CVE-2022-20110 (published 2022-05-03)
In ion, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06399915; Issue ID: ALPS06399901.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-367
Affected vendors: google, mediatek
Affected products: android, mt6580, mt6735, mt6737, mt6739, mt6750, mt6750s, mt6753, mt6757, mt6757c, mt6757cd, mt6757ch, mt6761, mt6762, mt6763, mt6765, mt6768, mt6769, mt6771, mt6779, mt6781, mt6785, mt6797, mt6833, mt6853
CVE-2022-20111 (published 2022-05-03)
In ion, there is a possible use after free due to incorrect error handling. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06366069; Issue ID: ALPS06366069.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-755
Affected vendors: google, mediatek
Affected products: android, mt6580, mt6735, mt6737, mt6739, mt6750, mt6750s, mt6753, mt6757, mt6757c, mt6757cd, mt6757ch, mt6761, mt6762, mt6763, mt6765, mt6768, mt6769, mt6771, mt6779, mt6781, mt6785, mt6797, mt6833, mt6853
CVE-2022-20112 (published 2022-05-10)
In getAvailabilityStatus of PrivateDnsPreferenceController.java, there is a possible way for a guest user to change private DNS settings due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-206987762
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-269
Affected vendors: google
Affected products: android
CVE-2022-20113 (published 2022-05-10)
In mPreference of DefaultUsbConfigurationPreferenceController.java, there is a possible way to enable file transfer mode due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12LAndroid ID: A-205996517
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: google
Affected products: android
CVE-2022-20114 (published 2022-05-10)
In placeCall of TelecomManager.java, there is a possible way for an application to keep itself running with foreground service importance due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-211114016
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-269
Affected vendors: google
Affected products: android
CVE-2022-20115 (published 2022-05-10)
In broadcastServiceStateChanged of TelephonyRegistry.java, there is a possible way to learn base station information without location permission due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12LAndroid ID: A-210118427
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-862
Affected vendors: google
Affected products: android
CVE-2022-20116 (published 2022-05-10)
In onEntryUpdated of OngoingCallController.kt, it is possible to launch non-exported activities due to intent redirection. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12LAndroid ID: A-212467440
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: google
Affected products: android
CVE-2022-20117 (published 2022-05-10)
In (TBD) of (TBD), there is a possible way to decrypt local data encrypted by the GSC due to improperly used crypto. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-217475903References: N/A
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-327
Affected vendors: google
Affected products: android
CVE-2022-20118 (published 2022-05-10)
In ion_ioctl and related functions of ion.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-205707793References: N/A
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-362
Affected vendors: google
Affected products: android
CVE-2022-20119 (published 2022-05-10)
In private_handle_t of mali_gralloc_buffer.h, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-213170715References: N/A
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-908
Affected vendors: google
Affected products: android
CVE-2022-20120 (published 2022-05-10)
Product: AndroidVersions: Android kernelAndroid ID: A-203213034References: N/A
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: google
Affected products: android
CVE-2022-20121 (published 2022-05-10)
In getNodeValue of USCCDMPlugin.java, there is a possible disclosure of ICCID due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-212573046References: N/A
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-862
Affected vendors: google
Affected products: android
CVE-2022-20122 (published 2022-08-24)
The PowerVR GPU driver allows unprivileged apps to allocated pinned memory, unpin it (which makes it available to be freed), and continue using the page in GPU calls. No privileges required and this results in kernel memory corruption.Product: AndroidVersions: Android SoCAndroid ID: A-232441339
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: google
Affected products: android
CVE-2022-20123 (published 2022-06-15)
In phNciNfc_RecvMfResp of phNxpExtns_MifareStd.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-221852424
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-125
Affected vendors: google
Affected products: android
CVE-2022-20124 (published 2022-06-15)
In deletePackageX of DeletePackageHelper.java, there is a possible way for a Guest user to reset pre-loaded applications for other users due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-170646036
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: google
Affected products: android
CVE-2022-20125 (published 2022-06-15)
In GBoard, there is a possible way to bypass factory reset protections due to a sandbox escape. This could lead to local escalation of privilege if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-194402515
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: google
Affected products: android