Summary
Google heeft kwetsbaarheden verholpen in Android. In deze update zijn ook updates meegenomen voor closed-source componenten van Qualcomm, Imagination Technologies en MediaTek.
Samsung heeft kwetsbaarheden in Samsung Mobile verholpen die relevant zijn voor Samsung mobile devices.
Details
Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om een Denial-of-Service te veroorzaken, zichzelf verhoogde rechten toe te kennen, toegang te krijgen tot gevoelige gegevens of willekeurige code uit te voeren.
Voor succesvol misbruik moet de kwaadwillende het slachtoffer misleiden een malafide app te installeren en draaien, of een malafide link te volgen.
Google heeft verder zoals gebruikelijk weinig inhoudelijke informatie beschikbaar gesteld.
Oplossingen
Google heeft updates uitgebracht om de kwetsbaarheden te verhelpen in Android 12,13 en 14.
Samsung heeft updates uitgebracht om kwetsbaarheden die relevant zijn voor Samsung Mobile devices te verhelpen.
Zie bijgevoegde referenties voor meer informatie.
Vulnerabilities 49
-
Critical 9.8
In wlan STA FW, there is a possible out of bounds write due to improper input validation. This could lead to remote (pr…
-
Critical 9.8
In gatts_process_read_by_type_req of gatt_sr.cc, there is a possible out of bounds write due to a logic error in the co…
-
Critical 9.8
In gatts_process_primary_service_req of gatt_sr.cc, there is a possible out of bounds write due to a heap buffer overfl…
-
High 8.8CVE-2024-20154 Public exploit
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code executi…
-
High 8.8
In build_read_multi_rsp of gatt_sr.cc, there is a possible out of bounds write due to a missing bounds check. This coul…
-
High 8.8
In gatts_process_find_info of gatt_sr.cc, there is a possible out of bounds write due to a missing bounds check. This c…
-
High 8.8
In gatts_process_read_req of gatt_sr.cc, there is a possible out of bounds write due to a missing bounds check. This co…
-
High 8.8
In DGifSlurp of dgif_lib.c, there is a possible out of bounds write due to an integer overflow. This could lead to remo…
-
High 8.4
Buffer Copy Without Checking Size of Input in Data Network Stack & Connectivity
Memory corruption while processing IPA statistics, when there are no active clients registered.
-
High 8.4
GPU DDK - PowerVR: PVRSRVAcquireProcessHandleBase can cause psProcessHandleBase reuse when PIDs are reused
Software installed and run as a non-privileged user may conduct improper GPU system calls to gain access to the graphics buffers of a parent process.
-
High 8.1
In wlan STA driver, there is a possible out of bounds write due to improper input validation. This could lead to remote…
-
High 7.8
In setActualDefaultRingtoneUri of RingtoneManager.java, there is a possible way to bypass content providers read permis…
-
High 7.8
In multiple locations, there is a possible bypass of user consent to enabling new Bluetooth HIDs due to a logic error i…
-
High 7.8
In multiple locations, there is a possible way to obtain any system permission due to a logic error in the code. This c…
-
High 7.8
In multiple locations, there is a possible way to obtain access to a folder due to a tapjacking/overlay attack. This co…
-
High 7.8
Use After Free in DSP Services
Memory corruption can occur when process-specific maps are added to the global list. If a map is removed from the global list while another thread is using it for a process-specific task, issues may arise.
-
High 7.8
In multiple functions of CompanionDeviceManagerService.java, there is a possible way to grant permissions without user …
-
High 7.8
In multiple locations, there is a possible failure to persist permissions settings due to resource exhaustion. This cou…
-
High 7.8
In applyTaskFragmentOperation of WindowOrganizerController.java, there is a possible way to launch arbitrary activities…
-
High 7.8
In writeInplace of Parcel.cpp, there is a possible out of bounds write. This could lead to local escalation of privileg…
-
High 7.8
In onCreate of NotificationAccessConfirmationActivity.java , there is a possible way to hide an app with notification a…
-
High 7.8
In checkKeyIntentParceledCorrectly of AccountManagerService.java, there is a possible way to bypass parcel mismatch mit…
-
High 7.8
In growData of Parcel.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to…
-
High 7.5
Buffer Over-read in WLAN Host Cmn
Transient DOS can occur when the driver parses the per STA profile IE and tries to access the EXTN element ID without checking the IE length.
-
High 7.5
In multiple functions of ConnectivityService.java, there is a possible way for a Wi-Fi AP to determine what site a devi…
-
High 7.4
In smp_proc_rand of smp_act.cc, there is a possible authentication bypass during legacy BLE pairing due to incorrect im…
-
High 7.0
In multiple functions of AccountManagerService.java, there is a possible way to bypass permissions and launch protected…
-
High 7.0
Out-of-bounds write in accessing buffer storing the decoded video frames in libsthmbc.so prior to SMR Jan-2025 Release …
-
High 7.0
Out-of-bounds write in accessing uninitialized memory for svc1td in libsthmbc.so prior to SMR Jan-2025 Release 1 allows…
-
High 7.0
Out-of-bounds write in handling the block size for smp4vtd in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local…
-
High 7.0
Out-of-bounds write in decoding frame buffer in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to …
-
Medium 6.7
In m4u, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of p…
-
Medium 6.7
In power, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of…
-
Medium 6.6
In V6 DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of…
-
Medium 6.6
In V6 DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of…
-
Medium 6.6
In V6 DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of…
-
Medium 6.5
In build_read_multi_rsp of gatt_sr.cc, there is a possible denial of service due to a logic error in the code. This cou…
-
Medium 6.4
Out-of-bounds write in softsim trustlet prior to SMR Jan-2025 Release 1 allows local privileged attackers to cause memo…
-
Medium 5.9
Protection Mechanism Failure in bootloader prior to SMR Jan-2025 Release 1 allows physical attackers to allow to execut…
-
Medium 5.5
In multiple locations, there is a possible way to access media content belonging to another user due to a missing permi…
-
Medium 5.5
In reload of ServiceListing.java , there is a possible way to allow a malicious app to hide an NLS from Settings due to…
-
Medium 5.5
In onClick of MainClear.java, there is a possible way to trigger factory reset without explicit user consent due to a l…
-
Medium 5.3
Out-of-bounds read in accessing table used for svp8t in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attac…
-
Medium 5.3
Out-of-bounds read in decoding malformed bitstream for smp4vtd in libsthmbc.so prior to SMR Jan-2025 Release 1 allows l…
-
Medium 5.3
Out-of-bounds read in decoding malformed bitstream of video thumbnails in libsthmbc.so prior to SMR Jan-2025 Release 1 …
-
Medium 5.1
Improper access control in NotificationManager prior to SMR Jan-2025 Release 1 allows local attackers to change the con…
-
Medium 4.6
Improper access control in SoundPicker prior to SMR Jan-2025 Release 1 allows physical attackers to access data across …
-
Medium 4.6
Improper access control in Samsung Message prior to SMR Jan-2025 Release 1 allows physical attackers to access data acr…
-
Medium 4.1
Inclusion of sensitive information in test code in softsim trustlet prior to SMR Jan-2025 Release 1 allows local privil…
Revision history
-
#0
Initiele versie
References
-
Reference - certbundde; cisagov; cveprojectv5; hkcert; nvd
https://security.samsungmobile.com/securityUpdate.smsb