CVE-2021-39796

NameCVE-2021-39796
DescriptionIn HarmfulAppWarningActivity of HarmfulAppWarningActivity.java, there is a possible way to trick victim to install harmful app due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-205595291
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1009626

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
android-platform-frameworks-base (PTS)bullseye1:10.0.0+r36-3vulnerable
bookworm1:10.0.0+r36-10vulnerable
trixie1:14~beta1-3vulnerable
forky, sid1:14~beta1-5vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
android-platform-frameworks-basesource(unstable)(unfixed)unimportant1009626

Notes

https://android.googlesource.com/platform/frameworks/base/+/e74a2a320bf896bc30618ce486203bafe453c469
https://source.android.com/security/bulletin/2022-04-01
No security impact for Android as provided in Debian, Not accessible in Debian builds
Search for package or bug name: Reporting problems