CVE-2020-0368: Input Validation
In queryInternal of CallLogProvider.java, there is a possible permission bypass due to improper input validation. This could lead to local information disclosure of voicemail metadata with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-143230980
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2020-0368?
CVE-2020-0368 is considered a moderate severity vulnerability due to its potential for local information disclosure.
How do I fix CVE-2020-0368?
To fix CVE-2020-0368, users should update their Android devices to the latest security patch provided by Google.
Who is affected by CVE-2020-0368?
CVE-2020-0368 affects Android 11.0 devices that utilize the CallLogProvider.
What type of attack does CVE-2020-0368 enable?
CVE-2020-0368 enables a possible permission bypass attack that could expose voicemail metadata.
Is user interaction required to exploit CVE-2020-0368?
No, user interaction is not needed for the exploitation of CVE-2020-0368.