CVE-2021-41256

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2021-41256

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-41256.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2021-41256

Aliases

GHSA-2q9v-q3cc-h9f3

Published

2021-11-30T21:15:08Z

Modified

2026-07-09T15:01:14Z

Severity

7.1 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N CVSS Calculator

Summary

[none]

Details

nextcloud news-android is an Android client for the Nextcloud news/feed reader app. In affected versions the Nextcloud News for Android app has a security issue by which a malicious application installed on the same device can send it an arbitrary Intent that gets reflected back, unintentionally giving read and write access to non-exported Content Providers in Nextcloud News for Android. Users should upgrade to version 0.9.9.63 or higher as soon as possible.

References

Affected packages

Git / github.com/nextcloud/news-android

Affected ranges

Type

GIT

Repo

https://github.com/nextcloud/news-android

Events

Introduced

Fixed

f922eccbb66539c481b8c2f6ca6ca796c6e41470

Fixed

05449cb666059af7de2302df9d5c02997a23df85

Database specific

Show details

{
    "cpe": "cpe:2.3:a:nextcloud:news:*:*:*:*:*:android:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.9.9.63"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

0.*

0.4.10

0.5.2

0.9.9.19

0.9.9.19.1

0.9.9.19.2

v.*

v.0.7.4

v.0.7.5

v.0.7.7

v.0.8.4

v.0.8.4.5

v.0.8.8

v.0.9.0

v.0.9.1

v.0.9.3

v.0.9.4

v.0.9.5

v.0.9.5.2

v.0.9.6.1

v.0.9.6.3

v.0.9.7

v.0.9.7.2

v.0.9.7.3

v.0.9.7.4

v.0.9.7.5

v.0.9.7.6

v.0.9.8

v.0.9.8.1

v.0.9.8.2

v.0.9.8.3

v.0.9.8.3.1

v.0.9.8.4

v.0.9.8.5

v.0.9.8.7

v.0.9.9.0

v.0.9.9.1

v.0.9.9.10

v.0.9.9.11

v.0.9.9.11-1

v.0.9.9.12

v.0.9.9.13

v.0.9.9.15

v.0.9.9.16

v.0.9.9.16.1

v.0.9.9.17.1

v.0.9.9.18

v.0.9.9.2

v.0.9.9.20

v.0.9.9.21

v.0.9.9.22

v.0.9.9.23

v.0.9.9.24

v.0.9.9.25

v.0.9.9.26

v.0.9.9.3

v.0.9.9.31

v.0.9.9.32

v.0.9.9.33

v.0.9.9.34

v.0.9.9.35

v.0.9.9.36

v.0.9.9.38

v.0.9.9.4

v.0.9.9.40

v.0.9.9.50

v.0.9.9.6

v.0.9.9.60

v.0.9.9.61

v.0.9.9.62

v.0.9.9.7

v.0.9.9.8

v.0.9.9.9

v.0.9.9.9.1

v0.*

v0.5.4

v0.5.5

v0.5.8

v0.6.1

v0.6.9.5

v0.9.9.35

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-41256.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "183887114535149891496406221583401254673",
            "length": 232
        },
        "id": "CVE-2021-41256-086eb739",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/nextcloud/news-android/commit/05449cb666059af7de2302df9d5c02997a23df85",
        "target": {
            "file": "News-Android-App/src/main/java/de/luhmer/owncloudnewsreader/SettingsActivity.java",
            "function": "onStart"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "141899385168248940446685660758705924838",
                "244800978941046954149367307266398676863",
                "41877304982036598563008459777714313541",
                "223744863353862852000523696365314266473",
                "138996754888375792500225206719808347359"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2021-41256-689aa7be",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/nextcloud/news-android/commit/05449cb666059af7de2302df9d5c02997a23df85",
        "target": {
            "file": "News-Android-App/src/main/java/de/luhmer/owncloudnewsreader/NewsReaderListActivity.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "328720867049808911310887293039361054237",
                "246127741562763585146183644876302088144",
                "257430442476808139659176132883107624348",
                "107640139098688655158529121404005807354",
                "170700116984773881292723086793174605089",
                "117044961784804718645526061331268291071",
                "39289828861905501262119063348073410471",
                "215370200594388182429856189135917507316",
                "174792718961590291071637339996378945656",
                "118603621017998757521845547991632654432",
                "85947836952222263266391953995227713637",
                "257175738044056229855623847545481850020",
                "120051494547413059793071454612840193226",
                "262385101131883859647873674044083162894",
                "89403782932651429855727681373668143383",
                "227860104627328427109797985642790337331"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2021-41256-8e024e22",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/nextcloud/news-android/commit/05449cb666059af7de2302df9d5c02997a23df85",
        "target": {
            "file": "News-Android-App/src/main/java/de/luhmer/owncloudnewsreader/SettingsActivity.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "132466537335342017437744983732951521615",
            "length": 388
        },
        "id": "CVE-2021-41256-d0ebe808",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/nextcloud/news-android/commit/05449cb666059af7de2302df9d5c02997a23df85",
        "target": {
            "file": "News-Android-App/src/main/java/de/luhmer/owncloudnewsreader/NewsReaderListActivity.java",
            "function": "ensureCorrectTheme"
        }
    }
]

vanir_signatures_modified

"2026-07-09T15:01:14Z"