PT-2020-11802 · Google · Android

Published 2020-12-01 · Updated 2020-12-15 · CVE-2020-0463

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Android versions 8.0 through 11

Description A possible out of bounds read due to a missing bounds check in the sdp server handle client req function of sdp server.cc could lead to remote information disclosure from the Bluetooth server. No additional execution privileges are needed, and user interaction is not required for exploitation.

Recommendations For Android versions 8.0 through 11, update to a version that includes the fix for this issue to prevent remote information disclosure.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ASB-A-169342531

CVE-2020-0463

Affected Products

Android

References · 5

• https://osv.dev/vulnerability/CVE-2020-0463 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-0463 · Security Note
• https://source.android.com/security/bulletin/2020-12-01 · Vendor Advisory
• https://osv.dev/vulnerability/ASB-A-169342531 · Vendor Advisory
• https://android.googlesource.com/platform/system/bt/+/938a5cd87c38bf35d15ffa3414c3a74faecb8bf8 · Note