CVE-2021-0584

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

In verifyBufferObject of Parcel.cpp, there is a possible out of bounds read due to an improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-179289794

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-125

Affected software

No affected versions have been published.

Timeline

Published
Aug 17, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-05856.7In beginWrite and beginRead of MessageQueueBase.h, there is a possible out of bounds write due to improper input validation. This could leadCVE-2021-05867.8In onCreate of DevicePickerFragment.java, there is a possible way to trick the user to select an unwanted bluetooth device due to a tapjackiCVE-2021-05877.8In StreamOut::prepareForWriting of StreamOut.cpp, there is a possible out of bounds write due to a use after free. This could lead to local CVE-2021-05885.5In processInboundMessage of MceStateMachine.java, there is a possible SMS disclosure due to a missing permission check. This could lead to lCVE-2021-05897.8In BTM_TryAllocateSCN of btm_scn.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escaCVE-2021-05904.4In sendNetworkConditionsBroadcast of NetworkMonitor.java, there is a possible way for a privileged app to receive WiFi BSSID and SSID withouCVE-2021-05917.3In sendReplyIntentToReceiver of BluetoothPermissionActivity.java, there is a possible way to invoke privileged broadcast receivers due to a CVE-2021-05928.8In various functions in WideVine, there are possible out of bounds writes due to improper input validation. This could lead to remote code eCVE-2021-05937.8In sendDevicePickedIntent of DevicePickerFragment.java, there is a possible way to invoke a privileged broadcast receiver due to a confused CVE-2021-05948.0In onCreate of ConfirmConnectActivity, there is a possible remote bypass of user consent due to improper input validation. This could lead tCVE-2021-05957.8In lockAllProfileTasks of RootWindowContainer.java, there is a possible way to access the work profile without the profile PIN, after logginCVE-2021-05967.5In phNciNfc_RecvMfResp of phNxpExtns_MifareStd.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to
CVE-2021-0584: Medium severity, CVSS 5.5 | Vulnix