Armoury Crate Service’s logging function has insufficient validation to check if the log file is a symbolic link. A physical attacker with general user privilege can modify the log file property to a symbolic link that points to arbitrary system file, causing the logging function to overwrite the system file and disrupt the system.

In messaging service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additional execution privileges needed.

In messaging service, there is a missing permission check. This could lead to access unexpected provider in contacts service with no additional execution privileges needed.

In camera driver, there is a possible memory corruption due to improper locking. This could lead to local denial of service in kernel.

Code Injection in GitHub repository froxlor/froxlor prior to 0.10.38.2.

In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.