platform/packages/modules/Bluetooth vulnerabilities (Android)
134 vulnerabilities.
-
platform/packages/modules/BluetoothAndroid In l2c_fcr_process_peer_cfg_req of l2c_fcr.cc, there is a possible memory safety issue due to an... No score -
platform/packages/modules/BluetoothAndroid In multiple locations, there is a possible side channel information leak due to improperly used... No score -
platform/packages/modules/BluetoothAndroid In handle_app_val_response of btif_rc.cc, there is a possible way to achieve code execution due... 7.0 High -
platform/packages/modules/BluetoothAndroid In cfg2prop of btif_storage.cc, there is a possible out-of-bounds write due to a heap buffer... 8.8 High -
platform/packages/modules/BluetoothAndroid In FilterCapturedPacket of snoop_logger.cc, there is a possible memory safety issue due to... 7.8 High -
platform/packages/modules/BluetoothAndroid In handle_le_monitor_device_event of msft.cc, there is a possible control-flow hijack in the... 7.8 High -
platform/packages/modules/BluetoothAndroid In a2dp_vendor_opus_decoder_decode_packet of a2dp_vendor_opus_decoder.cc, there is a possible out... 7.8 High -
platform/packages/modules/BluetoothAndroid In handleBondStateChanged of AdapterService.java, there is a possible way to skip pairing due to... 9.8 Critical -
platform/packages/modules/BluetoothAndroid In multiple locations, there is a possible improper encryption key validation due to a logic... 7.8 High -
platform/packages/modules/BluetoothAndroid In multiple locations, there is a possible way to bypass user interaction when pairing an LE... 8.0 High -
platform/packages/modules/BluetoothAndroid In l2c_fcr_clone_buf of l2c_fcr.cc, there is a possible way to trigger controlled heap corruption... 8.0 High -
platform/packages/modules/BluetoothAndroid In multiple functions of sdp_discovery.cc, there is a possible way to achieve code execution due... 8.0 High -
platform/packages/modules/BluetoothAndroid In handleBondStateChanged of AdapterService.java, there is a possible sensitive information... 3.3 Low -
platform/packages/modules/BluetoothAndroid In bta_jv_rfcomm_connect of bta_jv_act.cc, there is a possible bypass of bonding for a secure... 7.8 High -
platform/packages/modules/BluetoothAndroid In multiple functions of btm_ble_sec.cc, there is a possible unencrypted communication due to... 6.5 Medium -
platform/packages/modules/BluetoothAndroid In bta_hf_client_cb_init of bta_hf_client_main.cc, there is a possible remote code execution due... 8.0 High -
platform/packages/modules/BluetoothAndroid In SendPacketToPeer of acl_arbiter.cc, there is a possible out of bounds read due to a use after... 8.0 High -
platform/packages/modules/BluetoothAndroid In avrc_vendor_msg of avrc_opt.cc, there is a possible out of bounds write due to a heap buffer... 7.8 High -
platform/packages/modules/BluetoothAndroid In isContentUriForOtherUser of BluetoothOppSendFileInfo.java, there is a possible cross user data... 5.5 Medium -
platform/packages/modules/BluetoothAndroid In add_attr of sdp_discovery.cc, there is a possible out of bounds read due to a missing bounds... 6.5 Medium -
platform/packages/modules/BluetoothAndroid In smp_process_secure_connection_oob_data of smp_act.cc, there is a possible way to bypass SMP... 8.8 High -
platform/packages/modules/BluetoothAndroid In bta_av_config_ind of bta_av_aact.cc, there is a possible out of bounds read due to type... 4.0 Medium -
platform/packages/modules/BluetoothAndroid In avdt_msg_ind of avdt_msg.cc, there is a possible memory corruption due to type confusion. This... 9.8 Critical -
platform/packages/modules/BluetoothAndroid In generateFileInfo of BluetoothOppSendFileInfo.java, there is a possible cross user media... 5.5 Medium -
platform/packages/modules/BluetoothAndroid In multiple functions of sdp_server.cc, there is a possible use after free due to a logic error... 8.8 High -
platform/packages/modules/BluetoothAndroid In process_service_attr_rsp of sdp_discovery.cc, there is a possible use after free due to a... 8.8 High -
platform/packages/modules/BluetoothAndroid In multiple locations, there is a possible way to execute arbitrary code due to a use after free.... 8.4 High -
platform/packages/modules/BluetoothAndroid In rfc_send_buf_uih of rfc_ts_frames.cc, there is a possible way to execute arbitrary code due to... 8.4 High -
platform/packages/modules/BluetoothAndroid In rfc_check_send_cmd of rfc_utils.cc, there is a possible way to execute arbitrary code due to a... 9.8 Critical -
platform/packages/modules/BluetoothAndroid In hidd_check_config_done of hidd_conn.cc, there is a possible way to execute arbitrary code due... 5.5 Medium -
platform/packages/modules/BluetoothAndroid In bnepu_check_send_packet of bnep_utils.cc, there is a possible way to achieve code execution... 8.4 High -
platform/packages/modules/BluetoothAndroid In multiple locations, there is a possible way to execute arbitrary code due to a use after free.... 8.4 High -
platform/packages/modules/BluetoothAndroid In avct_lcb_msg_ind of avct_lcb_act.cc, there is a possible way to execute arbitrary code due to... 8.4 High -
platform/packages/modules/BluetoothAndroid In sdp_snd_service_search_req of sdp_discovery.cc, there is a possible way to execute arbitrary... 9.8 Critical -
platform/packages/modules/BluetoothAndroid In handleBondStateChanged of AdapterService.java, there is a possible unapproved data access due... 7.5 High -
platform/packages/modules/BluetoothAndroid In handleBondStateChanged of AdapterService.java, there is a possible permission bypass due to... 6.5 Medium -
platform/packages/modules/BluetoothAndroid In multiple locations, there is a possible out of bounds write due to a use after free. This... 8.8 High -
platform/packages/modules/BluetoothAndroid In multiple locations, there is a possible way that avdtp and avctp channels could be unencrypted... 7.8 High -
platform/packages/modules/BluetoothAndroid In process_service_search_attr_req of sdp_server.cc, there is a possible way to execute arbitrary... 9.8 Critical -
platform/packages/modules/BluetoothAndroid In process_service_attr_rsp of sdp_discovery.cc, there is a possible way to execute arbitrary... 9.8 Critical -
platform/packages/modules/BluetoothAndroid In gatts_process_primary_service_req of gatt_sr.cc, there is a possible out of bounds write due... 9.8 Critical -
platform/packages/modules/BluetoothAndroid In gatts_process_read_by_type_req of gatt_sr.cc, there is a possible out of bounds write due to a... 9.8 Critical -
platform/packages/modules/BluetoothAndroid In gatts_process_read_req of gatt_sr.cc, there is a possible out of bounds write due to a missing... 8.8 High -
platform/packages/modules/BluetoothAndroid In gatts_process_find_info of gatt_sr.cc, there is a possible out of bounds write due to a... 8.8 High -
platform/packages/modules/BluetoothAndroid In build_read_multi_rsp of gatt_sr.cc, there is a possible denial of service due to a logic error... 6.5 Medium -
platform/packages/modules/BluetoothAndroid In build_read_multi_rsp of gatt_sr.cc, there is a possible out of bounds write due to a missing... 8.8 High -
platform/packages/modules/BluetoothAndroid In multiple locations, there is a possible bypass of user consent to enabling new Bluetooth HIDs... 7.8 High -
platform/packages/modules/BluetoothAndroid In multiple locations, there is a possible permissions bypass due to a missing null check. This... 7.8 High -
platform/packages/modules/BluetoothAndroid In sdpu_compare_uuid_with_attr of sdp_utils.cc, there is a possible out of bounds read due to a... 7.5 High -
platform/packages/modules/BluetoothAndroid In smp_proc_rand of smp_act.cc, there is a possible authentication bypass during legacy BLE... 8.8 High - Show olderLoading…