Joshua Drake

The issue allows remote attackers to cause a denial of service, resulting in a device hang or reboot, via a crafted file.

The issue is related to the `SMSDispatcher.java` in Telephony, which does not properly construct warnings about premium SMS messages. This allows attackers to spoof the premium-payment confirmation dialog via a crafted application.

The issue allows remote attackers to execute arbitrary code via crafted metadata in a MP3 or MP4 file. This is due to insufficient input validation in the libutils library.

The issue allows remote attackers to execute arbitrary code via an Excel file with a Shared String Table (SST) record containing a numeric field that specifies an invalid number of unique strings, triggering a heap-based buffer overflow. This could enable an attacker to take complete control of an affected system, allowing them to install programs, view, change, or delete data, or create new accounts with full user rights.