|OpenHarmony-SA-2022-0601 | NA | The notification subsystem in OpenHarmony has an authentication bypass vulnerability when deserialize an object.| Local attackers can bypass authenication and crash the server process. |OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS<br/>OpenHarmony-v3.1-Release|notification_common_event_service| [3.0.x](https://gitee.com/openharmony/notification_common_event_service/pulls/269)<br/>[3.1.x](https://gitee.com/openharmony/notification_common_event_service/pulls/288) |Reported by OpenHarmony Team|
|OpenHarmony-SA-2022-0601 | NA | The notification subsystem in OpenHarmony has an authentication bypass vulnerability when deserialize an object.| Local attackers can bypass authenication and crash the server process. |OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS<br/>OpenHarmony-v3.1-Release|notification_common_event_service| [3.0.x](https://gitee.com/openharmony/notification_common_event_service/pulls/402)<br/>[3.1.x](https://gitee.com/openharmony/notification_common_event_service/pulls/288) |Reported by OpenHarmony Team|
|OpenHarmony-SA-2022-0602 | NA | The notification subsystem in OpenHarmony has an authentication bypass vulnerability which allows an "SA relay attack". | Local attackers can bypass authentication and get system control. |OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS|notification_common_event_service| [3.0.x](https://gitee.com/openharmony/notification_common_event_service/pulls/245) |Reported by OpenHarmony Team|
|OpenHarmony-SA-2022-0603 | NA | The updateservice in OpenHarmony has an authentication bypass vulnerability which allows an "SA relay attack". | Local attackers can bypass authentication and get system control. |OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS|update_updateservice| [3.0.x](https://gitee.com/openharmony/update_updateservice/pulls/115) |Reported by OpenHarmony Team|
|OpenHarmony-SA-2022-0604 | NA | The multimedia subsystem in OpenHarmony has an authentication bypass vulnerability which allows an "SA relay attack". | Local attackers can bypass authentication and get system control. |OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS|multimedia_media_standard| [3.0.x](https://gitee.com/openharmony/multimedia_media_standard/pulls/567) |Reported by OpenHarmony Team|
|OpenHarmony-SA-2022-0701 | NA | The bluetooth in communication subsystem has a DoS vulnerability. | Local attackers can trigger a large loop and crash the process. |OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS|communication_bluetooth| [3.0.x](https://gitee.com/openharmony/communication_bluetooth/pulls/179) |Reported by OpenHarmony Team|
|OpenHarmony-SA-2022-0702 | NA | The updater in update subsystem has a null pointer reference vulnerability. | Local attackers can input a nullptr and crash the process. |OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS|update_updater| [3.0.x](https://gitee.com/openharmony/update_updater/pulls/101) |Reported by OpenHarmony Team|
|OpenHarmony-SA-2022-0703 | NA | The dsoftbus in communication subsystem has an authentication bypass vulnerability which allows an "SA relay attack". | Local attackers can bypass authentication and get system control. |OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS|communication_dsoftbus| [3.0.x](https://gitee.com/openharmony/communication_dsoftbus/pulls/142) |Reported by OpenHarmony Team|
|OpenHarmony-SA-2022-0703 | NA | The dsoftbus in communication subsystem has an authentication bypass vulnerability which allows an "SA relay attack". | Local attackers can bypass authentication and get system control. |OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.5-LTS|communication_dsoftbus| [3.0.x](https://gitee.com/openharmony/communication_dsoftbus/pulls/2140) |Reported by OpenHarmony Team|
### The following table lists the third-party library vulnerabilities with only the CVE, severity, and affected OpenHarmony versions provided. For more details, see the security bulletins released by third-parties.
|OpenHarmony-SA-2022-0801 | NA | DecodeUCS2Data in telephony_sms_mms component of telephony subsystem, has a DoS vulnerability. | Network attackers can access illegal memory and crash the process.|OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS<br/>OpenHarmony-v3.1-Release|telephony_sms_mms| [3.0.x](https://gitee.com/openharmony/telephony_sms_mms/pulls/404)<br/>[3.1.x](https://gitee.com/openharmony/telephony_sms_mms/pulls/355) |Reported by OpenHarmony Team|
|OpenHarmony-SA-2022-0802 | NA | DecodeGSMData in telephony_sms_mms component of telephony subsystem, has a DoS vulnerability. | Network attackers can access illegal memory and crash the process.|OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS<br/>OpenHarmony-v3.1-Release|telephony_sms_mms| [3.0.x](https://gitee.com/openharmony/telephony_sms_mms/pulls/404)<br/>[3.1.x](https://gitee.com/openharmony/telephony_sms_mms/pulls/355) |Reported by OpenHarmony Team|
|OpenHarmony-SA-2022-0803 | NA | DecodeAddress in telephony_sms_mms component of telephony subsystem, has a DoS vulnerability. | Network attackers can access illegal memory and crash the process.|OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS<br/>OpenHarmony-v3.1-Release|telephony_sms_mms| [3.0.x](https://gitee.com/openharmony/telephony_sms_mms/pulls/404)<br/>[3.1.x](https://gitee.com/openharmony/telephony_sms_mms/pulls/355) |Reported by OpenHarmony Team|
|OpenHarmony-SA-2022-0804 | NA | Decode8bitData in telephony_sms_mms component of telephony subsystem, has a DoS vulnerability. | Network attackers can access illegal memory and crash the process.|OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS<br/>OpenHarmony-v3.1-Release|telephony_sms_mms| [3.0.x](https://gitee.com/openharmony/telephony_sms_mms/pulls/404)<br/>[3.1.x](https://gitee.com/openharmony/telephony_sms_mms/pulls/355) |Reported by OpenHarmony Team|
|OpenHarmony-SA-2022-0801 | NA | DecodeUCS2Data in telephony_sms_mms component of telephony subsystem, has a DoS vulnerability. | Network attackers can access illegal memory and crash the process.|OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.5-LTS<br/>OpenHarmony-v3.1-Release|telephony_sms_mms| [3.0.x](https://gitee.com/openharmony/telephony_sms_mms/pulls/404)<br/>[3.1.x](https://gitee.com/openharmony/telephony_sms_mms/pulls/355) |Reported by OpenHarmony Team|
|OpenHarmony-SA-2022-0802 | NA | DecodeGSMData in telephony_sms_mms component of telephony subsystem, has a DoS vulnerability. | Network attackers can access illegal memory and crash the process.|OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.5-LTS<br/>OpenHarmony-v3.1-Release|telephony_sms_mms| [3.0.x](https://gitee.com/openharmony/telephony_sms_mms/pulls/404)<br/>[3.1.x](https://gitee.com/openharmony/telephony_sms_mms/pulls/355) |Reported by OpenHarmony Team|
|OpenHarmony-SA-2022-0803 | NA | DecodeAddress in telephony_sms_mms component of telephony subsystem, has a DoS vulnerability. | Network attackers can access illegal memory and crash the process.|OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.5-LTS<br/>OpenHarmony-v3.1-Release|telephony_sms_mms| [3.0.x](https://gitee.com/openharmony/telephony_sms_mms/pulls/404)<br/>[3.1.x](https://gitee.com/openharmony/telephony_sms_mms/pulls/355) |Reported by OpenHarmony Team|
|OpenHarmony-SA-2022-0804 | NA | Decode8bitData in telephony_sms_mms component of telephony subsystem, has a DoS vulnerability. | Network attackers can access illegal memory and crash the process.|OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.5-LTS<br/>OpenHarmony-v3.1-Release|telephony_sms_mms| [3.0.x](https://gitee.com/openharmony/telephony_sms_mms/pulls/404)<br/>[3.1.x](https://gitee.com/openharmony/telephony_sms_mms/pulls/355) |Reported by OpenHarmony Team|
|OpenHarmony-SA-2022-0806 | NA | SendMessage in dsoftbus in communication subsystem has a permission bypass vulnerability. | Local attackers can bypass the permission check, and write any data into network devices. |OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS<br/>OpenHarmony-v3.1-Release through OpenHarmony-v3.1.1-Release|communication_dsoftbus| [3.0.x](https://gitee.com/openharmony/communication_dsoftbus/pulls/1668) |Reported by OpenHarmony Team|
### The following table lists the third-party library vulnerabilities with only the CVE, severity, and affected OpenHarmony versions provided. For more details, see the security bulletins released by third-parties.
