{"id":"PUB-A-227203202","details":"In onCreate of various files, there is a possible tapjacking/overlay attack. This could lead to local escalation of privilege or denial of server with User execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-227203202","CVE-2022-20520"],"modified":"2026-09-21T16:00:45.521740994Z","published":"2022-12-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-12-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/apps/Stk/+/aa8d8c37e1949286191649d9e9d97e750a948cf9"}],"affected":[{"package":{"name":"platform/packages/apps/Stk","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2022-12-01"}]}],"versions":["13"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"309734534497432772469917657419153149903","length":617},"id":"PUB-A-227203202-11aa166a","match_only_versions":["13"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Stk/+/aa8d8c37e1949286191649d9e9d97e750a948cf9","target":{"file":"src/com/android/stk/StkLauncherActivity.java","function":"onCreate"}},{"target":{"file":"src/com/android/stk/StkMenuActivity.java"},"deprecated":false,"digest":{"line_hashes":["16331319415692900664991263969000373563","32903674284224779181547872332270240803","211070783403493648112129447320963906457","244434845725369027276330620267359026212","73239568632359670494613682591538814959","197215194042162855357850914485248454205","99753812936198728448509833078318710468"],"threshold":0.9},"id":"PUB-A-227203202-2641679f","match_only_versions":["13"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Stk/+/aa8d8c37e1949286191649d9e9d97e750a948cf9"},{"source":"https://android.googlesource.com/platform/packages/apps/Stk/+/aa8d8c37e1949286191649d9e9d97e750a948cf9","target":{"file":"src/com/android/stk/StkMain.java"},"deprecated":false,"digest":{"line_hashes":["241242705770390988074840894613341378826","190692794809729418785506080489809720897","207902758835253731781455480966443601316","44867289360513004971923989391930119081","319996437674898363782099646389683858209","312602895836139089927325441524962386480","177321378019546070655227650611608802409","227653540069485357998745333255455950884","117760190030289119568660487474991547211","264379416716377859673012494519317171038","52697215222843997533201199953393280425","63607581916527271179809722877198719985"],"threshold":0.9},"id":"PUB-A-227203202-448fb754","match_only_versions":["13"],"signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Stk/+/aa8d8c37e1949286191649d9e9d97e750a948cf9","target":{"function":"onCreate","file":"src/com/android/stk/StkMain.java"},"deprecated":false,"digest":{"length":508,"function_hash":"264175413917839377381362683111597863090"},"id":"PUB-A-227203202-58c31766","match_only_versions":["13"]},{"source":"https://android.googlesource.com/platform/packages/apps/Stk/+/aa8d8c37e1949286191649d9e9d97e750a948cf9","target":{"file":"src/com/android/stk/StkInputActivity.java"},"deprecated":false,"digest":{"line_hashes":["267134777182661031288311122685343365817","168182571199202845242101970930948947241","40193802604750625517091337172587696943","335721937821416434163224023652736054925","305916075540227081900169820995332742553","26451365619367616917929927258293531288"],"threshold":0.9},"id":"PUB-A-227203202-692a204a","match_only_versions":["13"],"signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Stk/+/aa8d8c37e1949286191649d9e9d97e750a948cf9","target":{"file":"src/com/android/stk/StkMenuActivity.java","function":"onCreate"},"deprecated":false,"digest":{"length":922,"function_hash":"155833520515330337672182973973844465936"},"id":"PUB-A-227203202-b7f012f6","match_only_versions":["13"],"signature_type":"Function"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Stk/+/aa8d8c37e1949286191649d9e9d97e750a948cf9","target":{"file":"src/com/android/stk/StkLauncherActivity.java"},"deprecated":false,"digest":{"line_hashes":["243272355353562054059668005575964707016","322236995186957116070157815819765240660","277005766192158027755913485286841756679","271155950153697847955282722810889591830","36553800295712200038380029995972069497","14471384069313488771991165141786064867","218942731283702111993011917556327795195","12052827426037265803328229915546657477","252045884849488243815678929528999387218","264379416716377859673012494519317171038","52697215222843997533201199953393280425","63607581916527271179809722877198719985"],"threshold":0.9},"id":"PUB-A-227203202-c2707462","match_only_versions":["13"],"signature_type":"Line"},{"source":"https://android.googlesource.com/platform/packages/apps/Stk/+/aa8d8c37e1949286191649d9e9d97e750a948cf9","target":{"function":"onCreate","file":"src/com/android/stk/StkInputActivity.java"},"deprecated":false,"digest":{"length":1242,"function_hash":"10905916639519345456858877326694946625"},"id":"PUB-A-227203202-ee2909cb","match_only_versions":["13"],"signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/apps/Stk/+/aa8d8c37e1949286191649d9e9d97e750a948cf9"],"severity":"Moderate","spl":"2022-12-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/PUB-A-227203202.json"}}],"schema_version":"1.9.0"}