CVE-2011-0680
data/WorkingMessage.java in the Mms application in Android before 2.2.2 and 2.3.x before 2.3.2...
data/WorkingMessage.java in the Mms application in Android before 2.2.2 and 2.3.x before 2.3.2 does not properly manage the draft cache, which allows remote attackers to read SMS messages intended for other recipients in opportunistic circumstances via a standard text messaging service.
Exploit likelihood
What each source reports
NVD Score used
data/WorkingMessage.java in the Mms application in Android before 2.2.2 and 2.3.x before 2.3.2 does not properly manage the draft cache, which allows remote attackers to read SMS messages intended for other recipients in opportunistic circumstances via a standard text messaging service.
- Record
CVE-2011-0680- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
CVE List No score
data/WorkingMessage.java in the Mms application in Android before 2.2.2 and 2.3.x before 2.3.2 does not properly manage the draft cache, which allows remote attackers to read SMS messages intended for other recipients in opportunistic circumstances via a standard text messaging service.
- Record
CVE-2011-0680- Updated
- 2026-11-02
EUVDEUVD-2011-0698 No score
data/WorkingMessage.java in the Mms application in Android before 2.2.2 and 2.3.x before 2.3.2 does not properly manage the draft cache, which allows remote attackers to read SMS messages intended for other recipients in opportunistic circumstances via a standard text messaging service.
- Record
EUVD-2011-0698- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2m5p-7g2f-f542 No score
data/WorkingMessage.java in the Mms application in Android before 2.2.2 and 2.3.x before 2.3.2...
data/WorkingMessage.java in the Mms application in Android before 2.2.2 and 2.3.x before 2.3.2 does not properly manage the draft cache, which allows remote attackers to read SMS messages intended for other recipients in opportunistic circumstances via a standard text messaging service.
- Record
GHSA-2m5p-7g2f-f542- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-0680 is a medium vulnerability (CVSS 5.0) in Google Android, published January 31, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.84%, the 79th percentile. No source names a fixed version.
References
theinquirer.net/inquirer/news/1939386/google-updates-nexus-android-222
engadget.com/2011/01/22/nexus-one-gets-tiny-update-to-android-2-2-2-probably-fixes-sms
android.git.kernel.org?p=platform/packages/apps/Mms.git%3Ba=commit%3Bh=4d26623ce82230e8e7009adb921c5edea370a9e0
htcphones.net/nexus-one-update-to-android-2-2-2
twitter.com/GalaxySsupport/statuses/28078194607263744
securityfocus.com/bid/46105
Show 9 moreShow less
exchange.xforce.ibmcloud.com/vulnerabilities/65125
phandroid.com/2011/01/21/android-2-3-2-update-pushing-to-nexus-s-phone-fixes-sms-bug
samsunghub.com/2011/01/22/nexus-s-gets-android-2-3-2-fixes-sms-bug
code.google.com/p/android/issues/detail?id=9392
nvd.nist.gov/vuln/detail/CVE-2011-0680
github.com/advisories/GHSA-2m5p-7g2f-f542