CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 0CVE-2019-2128
https://notcve.org/view.php?id=CVE-2019-2128
20 Aug 2019 — In ACELP_4t64_fx of c4t64fx.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. • https://source.android.com/security/bulletin/2019-08-01 • CWE-787: Out-of-bounds Write •
CVSS: 9.3EPSS: 8%CPEs: 12EXPL: 0CVE-2019-2126 – libvpx: Double free in ParseContentEncodingEntry() in mkvparser.cc
https://notcve.org/view.php?id=CVE-2019-2126
20 Aug 2019 — In ParseContentEncodingEntry of mkvparser.cc, there is a possible double free due to a missing reset of a freed pointer. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00049.html • CWE-415: Double Free CWE-672: Operation on a Resource after Expiration or Release •
CVSS: 7.3EPSS: 0%CPEs: 6EXPL: 0CVE-2019-2125
https://notcve.org/view.php?id=CVE-2019-2125
20 Aug 2019 — In ChangeDefaultDialerDialog.java, there is a possible escalation of privilege due to an overlay attack. This could lead to local escalation of privilege, granting privileges to a local app without the user's informed consent, with no additional privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. • https://source.android.com/security/bulletin/2019-08-01 • CWE-1021: Improper Restriction of Rendered UI Layers or Frames •
CVSS: 7.3EPSS: 0%CPEs: 6EXPL: 0CVE-2019-2122
https://notcve.org/view.php?id=CVE-2019-2122
20 Aug 2019 — In LockTaskController.lockKeyguardIfNeeded of the LockTaskController.java, there was a difference in the handling of the default case between the WindowManager and the Settings. This could lead to a local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. • https://source.android.com/security/bulletin/2019-08-01 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 0CVE-2019-2120
https://notcve.org/view.php?id=CVE-2019-2120
20 Aug 2019 — In OatFileAssistant::GenerateOatFile of oat_file_assistant.cc, there is a possible file corruption issue due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. • https://source.android.com/security/bulletin/2019-08-01 • CWE-1188: Initialization of a Resource with an Insecure Default •
CVSS: 8.1EPSS: 3%CPEs: 371EXPL: 1CVE-2019-9506 – Blutooth BR/EDR specification does not specify sufficient encryption key length and allows an attacker to influence key length negotiation
https://notcve.org/view.php?id=CVE-2019-9506
14 Aug 2019 — The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and does not prevent an attacker from influencing the key length negotiation. This allows practical brute-force attacks (aka "KNOB") that can decrypt traffic and inject arbitrary ciphertext without the victim noticing. La especificación de Bluetooth BR/EDR incluyendo versión 5.1, permite una longitud de clave de cifrado suficientemente baja y no impide que un atacante influya en la negociación d... • https://github.com/francozappa/knob • CWE-310: Cryptographic Issues CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 0CVE-2019-14783 – Samsung Mobile Android FotaAgent Arbitrary File Creation
https://notcve.org/view.php?id=CVE-2019-14783
08 Aug 2019 — On Samsung mobile devices with N(7.x), and O(8.x), P(9.0) software, FotaAgent allows a malicious application to create privileged files. The Samsung ID is SVE-2019-14764. En dispositivos móviles Samsung con software N (7.x) y O (8.x), P (9.0), FotaAgent permite que una aplicación maliciosa cree archivos privilegiados. La identificación de Samsung es SVE-2019-14764. A vulnerability in Samsung Mobile Android FotaAgent allows creating privileged files without proper permission from an unprivileged process. • http://packetstormsecurity.com/files/154615/Samsung-Mobile-Android-FotaAgent-Arbitrary-File-Creation.html •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2019-5682
https://notcve.org/view.php?id=CVE-2019-5682
06 Aug 2019 — NVIDIA Shield TV Experience prior to v8.0, contains a vulnerability in the NVIDIA Games App where it improperly exports an Activity but does not properly restrict which applications can launch the Activity, which may lead to code execution or denial of service. Shield TV Experience de NVIDIA anterior a versión v8.0, contiene una vulnerabilidad en la aplicación NVIDIA Games donde exporta inapropiadamente una Actividad pero no restringe apropiadamente qué aplicaciones pueden activar la Actividad, lo que puede... • https://nvidia.custhelp.com/app/answers/detail/a_id/4804 •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2019-5679
https://notcve.org/view.php?id=CVE-2019-5679
06 Aug 2019 — NVIDIA Shield TV Experience prior to v8.0, NVIDIA Tegra bootloader contains a vulnerability in nvtboot where the Trusted OS image is improperly authenticated, which may lead to code execution, denial of service, escalation of privileges, and information disclosure, code execution, denial of service, or escalation of privileges Shield TV Experience de NVIDIA anterior a versión v8.0, el cargador de arranque de NVIDIA Tegra, contiene una vulnerabilidad en nvtboot donde la imagen de Trusted OS está autenticada ... • https://nvidia.custhelp.com/app/answers/detail/a_id/4804 • CWE-287: Improper Authentication •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2019-2119
https://notcve.org/view.php?id=CVE-2019-2119
08 Jul 2019 — In multiple functions of key_store_service.cpp, there is a possible Information Disclosure due to improper locking. This could lead to local information disclosure of protected data with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-8.0 Android-8.1 Android-9. • https://source.android.com/security/bulletin/2019-07-01 • CWE-667: Improper Locking •