Medium
android-platform-frameworks-base — security advisory
In getArray of NotificationManagerService.java , there is a possible leak of one user notifications to another due to missing check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-214999128
- Products
- android-platform-frameworks-base
- Affected versions
- 1:10.0.0+r36-10, 1:13.0.0+r30-1, 1:13.0.0+r30-1~exp1, 1:13.0.0+r30-1~exp2, 1:13.0.0+r30-1~exp3, 1:13.0.0+r30-1~exp4, 1:13.0.0+r66-1, 1:13.0.0+r66-1~exp1, 1:13~beta3-1~exp1, 1:14~beta1-1, 1:14~beta1-1~exp2, 1:14~beta1-1~exp~1, 1:14~beta1-2, 1:14~beta1-3, 1:14~beta1-4, 1:14~beta1-4~exp1, 1:14~beta1-5
- Fixed versions
- Not specified
- CVEs
- CVE-2022-20011
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 30 Oct 2026, 14:47 UTC · Revision 1
Source evidence
In getArray of NotificationManagerService.java , there is a possible leak of one user notifications to another due to missing check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-214999128
osv:DEBIAN-CVE-2022-20011
android-platform-frameworks-base
Fixed versions: Not specified
android-platform-frameworks-base
Fixed versions: Not specified
android-platform-frameworks-base
Fixed versions: Not specified
Complete source record
{
"id": "773da789570072068c131f576704d9113c90b27b41872581bc4ee447a88f910e",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2022-20011",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2022-20011",
"summary": "In getArray of NotificationManagerService.java , there is a possible leak of one user notifications to another due to missing check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-214999128",
"evidence": "osv:DEBIAN-CVE-2022-20011",
"products": [
{
"name": {
"value": "android-platform-frameworks-base",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1:10.0.0+r36-10",
"evidence": "/affected/0/versions"
},
{
"value": "1:13.0.0+r30-1",
"evidence": "/affected/0/versions"
},
{
"value": "1:13.0.0+r30-1~exp1",
"evidence": "/affected/0/versions"
},
{
"value": "1:13.0.0+r30-1~exp2",
"evidence": "/affected/0/versions"
},
{
"value": "1:13.0.0+r30-1~exp3",
"evidence": "/affected/0/versions"
},
{
"value": "1:13.0.0+r30-1~exp4",
"evidence": "/affected/0/versions"
},
{
"value": "1:13.0.0+r66-1",
"evidence": "/affected/0/versions"
},
{
"value": "1:13.0.0+r66-1~exp1",
"evidence": "/affected/0/versions"
},
{
"value": "1:13~beta3-1~exp1",
"evidence": "/affected/0/versions"
},
{
"value": "1:14~beta1-1",
"evidence": "/affected/0/versions"
},
{
"value": "1:14~beta1-1~exp2",
"evidence": "/affected/0/versions"
},
{
"value": "1:14~beta1-1~exp~1",
"evidence": "/affected/0/versions"
},
{
"value": "1:14~beta1-2",
"evidence": "/affected/0/versions"
},
{
"value": "1:14~beta1-3",
"evidence": "/affected/0/versions"
},
{
"value": "1:14~beta1-4",
"evidence": "/affected/0/versions"
},
{
"value": "1:14~beta1-4~exp1",
"evidence": "/affected/0/versions"
},
{
"value": "1:14~beta1-5",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "android-platform-frameworks-base",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1:14~beta1-3",
"evidence": "/affected/1/versions"
},
{
"value": "1:14~beta1-4",
"evidence": "/affected/1/versions"
},
{
"value": "1:14~beta1-4~exp1",
"evidence": "/affected/1/versions"
},
{
"value": "1:14~beta1-5",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "android-platform-frameworks-base",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1:14~beta1-3",
"evidence": "/affected/2/versions"
},
{
"value": "1:14~beta1-4",
"evidence": "/affected/2/versions"
},
{
"value": "1:14~beta1-4~exp1",
"evidence": "/affected/2/versions"
},
{
"value": "1:14~beta1-5",
"evidence": "/affected/2/versions"
}
]
}
],
"severity": "medium",
"structured": {
"id": "DEBIAN-CVE-2022-20011",
"aliases": [
"DEBIAN-CVE-2022-20011"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "android-platform-frameworks-base",
"purl": "pkg:deb/debian/android-platform-frameworks-base?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"1:10.0.0+r36-10",
"1:13.0.0+r30-1",
"1:13.0.0+r30-1~exp1",
"1:13.0.0+r30-1~exp2",
"1:13.0.0+r30-1~exp3",
"1:13.0.0+r30-1~exp4",
"1:13.0.0+r66-1",
"1:13.0.0+r66-1~exp1",
"1:13~beta3-1~exp1",
"1:14~beta1-1",
"1:14~beta1-1~exp2",
"1:14~beta1-1~exp~1",
"1:14~beta1-2",
"1:14~beta1-3",
"1:14~beta1-4",
"1:14~beta1-4~exp1",
"1:14~beta1-5"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-20011.json"
},
"ecosystem_specific": {
"urgency": "unimportant"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "android-platform-frameworks-base",
"purl": "pkg:deb/debian/android-platform-frameworks-base?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"1:14~beta1-3",
"1:14~beta1-4",
"1:14~beta1-4~exp1",
"1:14~beta1-5"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-20011.json"
},
"ecosystem_specific": {
"urgency": "unimportant"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "android-platform-frameworks-base",
"purl": "pkg:deb/debian/android-platform-frameworks-base?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"1:14~beta1-3",
"1:14~beta1-4",
"1:14~beta1-4~exp1",
"1:14~beta1-5"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-20011.json"
},
"ecosystem_specific": {
"urgency": "unimportant"
}
}
],
"modified": "2026-10-15T08:02:12.620906290Z",
"provider": "osv",
"upstream": [
"CVE-2022-20011"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2022-20011"
]
},
"related_cves": [
{
"value": "CVE-2022-20011",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 323312,
"published_at": "2022-05-10T20:15:09.147+00:00"
}