Qidan He

A TOCTOU race condition exists in `AppRestrictionsFragment.java` that allows an attacker to start a malicious activity within the Settings application's system-uid context, leading to the potential for launching any application. This occurs because of a time window between the verification of an `Intent` and its subsequent use, enabling manipulation of the target component's state and bypassing the original security checks.

The issue allows a malicious application to create privileged files through the FotaAgent component. This could potentially lead to unauthorized access or modifications to sensitive data.

The issue involves the `ImageIO` component and allows remote attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and application crash, via a crafted image file. This is caused by a buffer overflow in memory.

The issue involves the `IOKit` component and allows local users to obtain sensitive kernel memory-layout information via unspecified vectors. It is related to the lack of protection for service data, which can be exploited by a local attacker to access protected information about the kernel memory structure.

The issue involves the `IOSurface` component and allows local users to obtain sensitive kernel memory-layout information via unspecified vectors. This is related to a lack of protection for service data, which can be exploited by a local attacker to access protected information about the kernel memory scheme.

The issue involves the `IOAcceleratorFamily` component and allows local users to obtain sensitive kernel memory-layout information via unspecified vectors. This is related to a lack of protection for service data, which can be exploited by a local attacker to access protected kernel memory scheme information.

The issue involves the `IOKit` component and allows local users to obtain sensitive kernel memory-layout information via unspecified vectors. This is related to a lack of protection for service data, which can be exploited by a local attacker to access protected kernel memory scheme information.

A remote code execution issue in the Framesequence library could allow an attacker to execute arbitrary code using a specially crafted file. This issue is related to inadequate access control in the library. The problem can be exploited by a remote attacker to execute code in the context of an unprivileged process.

The issue allows attackers to execute arbitrary code in a privileged context or cause a denial of service due to memory corruption via a crafted app. It is related to a buffer overflow privilege escalation vulnerability in the AppleHSSPIHIDDriver.

The issue is related to insufficient access control in the PowerNotificationWarnings.java file, allowing attackers to bypass the DEVICE POWER permission requirement. This can be achieved by sending a broadcast intent with the `PNW.stopSaver` action. There is no information about the estimated number of potentially affected devices or real-world incidents where this issue was exploited.

The issue is related to the Android operating system's API framework, which lacks guarantees that package data originated from the Package Manager. This allows a remote attacker to bypass protection mechanisms using a specially crafted application.

The issue is related to errors in security settings of the Intel Graphics Driver component in Mac OS X, allowing a remote attacker to obtain sensitive kernel memory-layout information using a specially crafted app.

The issue is related to a buffer overflow in the IOAcceleratorFamily component, which can be exploited by attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app. This can be achieved by a remote attacker using a specially crafted application.

The issue is caused by an integer overflow in the BnCrypto::onTransact function, allowing attackers to obtain sensitive information and bypass an unspecified protection mechanism by triggering an improper size calculation. This can be exploited to obtain Signature or SignatureOrSystem access.

The issue is related to the libstagefright library in the Android operating system and is caused by a lack of protection for service data. It allows a remote attacker to obtain sensitive information and bypass an unspecified protection mechanism. The attacker can gain Signature or SignatureOrSystem access via unknown vectors.

The issue allows attackers to obtain sensitive information and bypass an unspecified protection mechanism via unknown vectors. This can be demonstrated by obtaining Signature or SignatureOrSystem access. The vulnerability is related to the lack of protection for service data, which can allow a remote attacker to obtain confidential information or bypass protection mechanisms.