Daniel Micay

The issue in the samsung extdisp driver allows attackers to potentially obtain sensitive information.

A remote code execution issue in the Surfaceflinger service could allow an attacker to cause memory corruption during media file and data processing by using a specially crafted file. This issue is rated as Critical due to the possibility of remote code execution within the context of the Surfaceflinger process. The vulnerability is caused by a buffer overflow in memory, which can be exploited by a remote attacker to inject arbitrary code.

An elevation of privilege issue in the Framework APIs could allow a local malicious application to execute arbitrary code within the context of a privileged process. This issue could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. The vulnerability is related to insufficient access control in the Framework APIs.

An information disclosure issue in the Mediaserver component of the Android operating system could allow a local malicious application to access data outside of its permission levels, potentially leading to unauthorized access to sensitive data. This issue could also be exploited by a remote attacker to cause a denial of service or other system impact.

The issue relies on variable-length arrays in libril/RilSapSocket.cpp, which allows attackers to gain privileges via a crafted application.