CVE-2013-6272

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

The NotificationBroadcastReceiver class in the com.android.phone process in Google Android 4.1.1 through 4.4.2 allows attackers to bypass intended access restrictions and consequently make phone calls to arbitrary numbers, send mmi or ussd codes, or hangup ongoing calls via a crafted application.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/127359/Android-OS-Authorization-Missing.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2014/Jul/13Exploit, Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/68415Third Party Advisory, VDB Entry
https://curesec.com/blog/article/blog/35.htmlExploit, Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/94423Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/127359/Android-OS-Authorization-Missing.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2014/Jul/13Exploit, Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/68415Third Party Advisory, VDB Entry
https://curesec.com/blog/article/blog/35.htmlExploit, Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/94423Third Party Advisory, VDB Entry

Timeline

Published: May 2, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-62756.5Multiple CSRF issues in Horde Groupware Webmail Edition 5.1.2 and earlier in basic.php.CVE-2013-62769.8QNAP F_VioCard 2312 and F_VioGate 2308 have hardcoded entries in authorized_keys files. NOTE: 1. All active models are not affected. The las CVE-2013-62777.5QNAP VioCard 300 has hardcoded RSA private keys.CVE-2013-62804.3Cross-site scripting (XSS) vulnerability in Social Sharing Toolkit plugin before 2.1.2 for WordPress allows remote attackers to inject arbit CVE-2013-62814.3Cross-site scripting (XSS) vulnerability in codebase/spreadsheet.php in the Spreadsheet (dhtmlxSpreadsheet) plugin 2.0 for WordPress allows CVE-2013-62828.8The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain add CVE-2013-62837.5VideoLAN VLC Media Player 2.0.8 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code CVE-2013-62847.5Unspecified vulnerability in the Statutory Reporting for Insurance (FS_SR) component in the Financial Services module for SAP ERP Central Co CVE-2013-62855.0The search component in the Treasurer application in Tyler Technologies TaxWeb 3.13.3.1 allows remote attackers to obtain sensitive query-st CVE-2013-628810.0Unspecified vulnerability in the Apache Solr for TYPO3 (solr) extension before 2.8.3 for TYPO3 has unknown impact and remote attack vectors,CVE-2013-62894.3Cross-site scripting (XSS) vulnerability in the Apache Solr for TYPO3 (solr) extension before 2.8.3 for TYPO3 allows remote attackers to inj CVE-2013-62959.8PrestaShop 1.5.5 vulnerable to privilege escalation via a Salesman account via upload module