CVE-2020-0020

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

In getAttributeRange of ExifInterface.java, there is a possible failure to redact location information from media files due to an incorrect bounds check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-143118731

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-119

Affected software

No affected versions have been published.

Timeline

Published
Feb 13, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-00216.5In removeUnusedPackagesLPw of PackageManagerService.java, there is a possible permanent denial-of-service due to a missing package dependencCVE-2020-00228.8In reassemble_and_dispatch of packet_fragmenter.cc, there is possible out of bounds write due to an incorrect bounds calculation. This couldCVE-2020-00235.5In setPhonebookAccessPermission of AdapterService.java, there is a possible disclosure of user contacts over bluetooth due to a missing permCVE-2020-00247.8In onCreate of SettingsBaseActivity.java, there is a possible unauthorized setting modification due to a permissions bypass. This could leadCVE-2020-00257.8In deletePackageVersionedInternal of PackageManagerService.java, there is a possible way to exit Screen Pinning due to a permissions bypass.CVE-2020-00267.8In Parcel::continueWrite of Parcel.cpp, there is possible memory corruption due to a use after free. This could lead to local escalation of CVE-2020-00277.8In HidRawSensor::batch of HidRawSensor.cpp, there is a possible out of bounds write due to an unexpected switch fallthrough. This could leadCVE-2020-00286.5In notifyNetworkTested and related functions of NetworkMonitor.java, there is a possible bypass of private DNS settings. This could lead to CVE-2020-00292.3In the WifiConfigManager, there is a possible storage of location history which can only be deleted by triggering a factory reset. This coulCVE-2020-00307.0In binder_thread_release of binder.c, there is a possible use after free due to a race condition. This could lead to local escalation of priCVE-2020-00315.0In triggerAugmentedAutofillLocked and related functions of Session.java, it is possible for Augmented Autofill to display sensitive informatCVE-2020-00328.8In ih264d_release_display_bufs of ih264d_utils.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to
CVE-2020-0020: Medium severity, CVSS 5.5 | Vulnix