Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um seine Privilegien zu erhöhen, um beliebigen Code auszuführen, vertrauliche Informationen offenzulegen und um einen Denial of Service Zustand herbeizuführen.
Product
Das Android Betriebssystem von Google ist eine quelloffene Plattform für mobile Geräte. Die Basis bildet der Linux-Kernel.
Vulnerabilities 67
-
Critical 9.8
Integer Overflow to Buffer Overflow in Bluetooth HOST
Memory corruption in Bluetooth HOST due to buffer overflow while parsing the command response received from remote
-
High 8.8
A use-after-free in the mac80211 stack when parsing a multi-BSSID element in the Linux kernel 5.2 through 5.19.x before…
-
High 8.4
Due to insufficient validation of ELF headers, an Incorrect Calculation of Buffer Size can occur in Boot leading to mem…
-
High 8.4
Improper validation of array index in Android Core
Memory corruption in android core due to improper validation of array index while returning feature ids after license authentication.
-
High 8.4
Buffer copy without checking size of input in Modem
Memory corruption due to buffer copy without checking size of input in modem while receiving WMI_REQUEST_STATS_CMDID command.
-
High 8.2
Buffer over-read in WLAN
Information disclosure due to buffer over-read in WLAN while handling IBSS beacons frame.
-
High 8.2
Buffer over-read in Bluetooth HOST
Information disclosure due to buffer over-read in Bluetooth HOST while processing GetFolderItems and GetItemAttribute Cmds from peer device.
-
High 8.2
Buffer over-read in WLAN
Information disclosure due to buffer over-read in WLAN while WLAN frame parsing due to missing frame length check.
-
High 8.2
Buffer over-read in WLAN
Information disclosure due to buffer over-read in WLAN while parsing BTM action frame.
-
High 8.1
Buffer Copy Without Checking Size of Input in Kernel
Memory corruption in kernel due to missing checks when updating the access rights of a memextent mapping.
-
High 8.1
An issue was discovered in the Linux kernel before 5.19.16. Attackers able to inject WLAN frames could cause a buffer o…
-
High 7.8
In AutomaticZenRule of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resour…
-
High 7.8
In pinReplyNative of com_android_bluetooth_btservice_AdapterService.cpp, there is a possible out of bounds read due to …
-
High 7.8
In many functions of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource…
-
High 7.8
In multiple functions of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to reso…
-
High 7.8
In many functions of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource…
-
High 7.8CVE-2022-20493 Public exploit
In Condition of Condition.java, there is a possible way to grant notification access due to improper input validation. …
-
High 7.8
In gps, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of p…
-
High 7.8
Various refcounting bugs in the multi-BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before …
-
High 7.8CVE-2023-20904 Public exploit
In getTrampolineIntent of SettingsActivity.java, there is a possible launch of arbitrary activity due to an Intent mism…
-
High 7.8
In Mfc_Transceive of phNxpExtns_MifareStd.cpp, there is a possible out of bounds write due to a missing bounds check. T…
-
High 7.8
In onActivityResult of AvatarPickerActivity.java, there is a possible way to access images belonging to other users due…
-
High 7.8
In onCreate of PhoneAccountSettingsActivity.java and related files, there is a possible way to mislead the user into en…
-
High 7.8
In addOrReplacePhoneAccount of PhoneAccountRegistrar.java, there is a possible way to enable a phone account without us…
-
High 7.8
In getMainActivityLaunchIntent of LauncherAppsService.java, there is a possible way to bypass the restrictions on start…
-
High 7.8
In getStringsForPrefix of Settings.java, there is a possible prevention of package uninstallation due to a logic error …
-
High 7.8
In queue of UsbRequest.java, there is a possible way to corrupt memory due to a use after free. This could lead to loca…
-
High 7.8
In setUclampMinLocked of PowerSessionManager.cpp, there is a possible way to corrupt memory due to a use after free. Th…
-
High 7.8
In binder_vma_close of binder.c, there is a possible use after free due to improper locking. This could lead to local e…
-
High 7.5
Buffer over-read in WLAN
Transient DOS due to buffer over-read in WLAN while parsing corrupted NAN frames.
-
High 7.5
Buffer over-read in WLAN
Transient DOS due to buffer over-read in WLAN while parsing WLAN CSA action frames.
-
High 7.5
Buffer over-read in WLAN
Transient DOS due to buffer over-read in WLAN while processing 802.11 management frames.
-
High 7.3
Possible authentication bypass due to improper order of signature verification and hashing in the signature verificatio…
-
High 7.3
Possible authentication bypass due to improper order of signature verification and hashing in the signature verificatio…
-
High 7.3CVE-2023-20921 Public exploit
In onPackageRemoved of AccessibilityManagerService.java, there is a possibility to automatically grant accessibility se…
-
Medium 6.8
In (TBD) of (TBD), there is a possible way to bypass the lockscreen due to Biometric Auth Failure. This could lead to l…
-
Medium 6.7
Incorrect type casting in Display driver
Memory corruption in display driver due to incorrect type casting while accessing the fence structure fields
-
Medium 6.7
Use-After-Free Issue in Display
Memory corruption in display due to double free while allocating frame buffer memory
-
Medium 6.7
Incorrect Type Conversion in Video driver
Memory corruption in video driver due to type confusion error during video playback
-
Medium 6.7
In keyinstall, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation …
-
Medium 6.7
In hevc decoder, there is a possible out of bounds write due to a missing bounds check. This could lead to local escala…
-
Medium 6.2
Use-after-Free in MODEM
Denial of service in MODEM due to improper pointer handling
-
Medium 6.0
Information Exposure in DSP Services
Information exposure in DSP services due to improper handling of freeing memory
-
Medium 5.9
Integer overflow to buffer overflow in Audio
Memory corruption in Audio due to integer overflow to buffer overflow while music playback of clips like amr,evrc,qcelp with modified content.
-
Medium 5.5
The PowerVR GPU kernel driver maintains an "Information Page" used by its cache subsystem. This page can only be writte…
-
Medium 5.5CVE-2022-20494 Public exploit
In AutomaticZenRule of AutomaticZenRule.java, there is a possible persistent DoS due to resource exhaustion. This could…
-
Medium 5.5
A list management bug in BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could…
-
Medium 5.5
In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
-
Medium 5.5
In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
-
Medium 5.5
In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
-
Medium 5.5
In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
-
Medium 5.5
In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
-
Medium 5.5
In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
-
Medium 5.5
In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
-
Medium 5.5
In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
-
Medium 5.5
In messaging service, there is a missing permission check. This could lead to local denial of service in contacts servi…
-
Medium 5.5
In messaging service, there is a missing permission check. This could lead to local denial of service in contacts servi…
-
Medium 5.5
In messaging service, there is a missing permission check. This could lead to local denial of service in contacts servi…
-
Medium 5.5
In messaging service, there is a missing permission check. This could lead to local denial of service in contacts servi…
-
Medium 5.5
In several functions of SettingsState.java, there is a possible system crash loop due to resource exhaustion. This coul…
-
Medium 5.5
In setMimeGroup of PackageManagerService.java, there is a possible crash loop due to resource exhaustion. This could le…
-
Medium 5.5
In exported content providers of ShannonRcs, there is a possible way to get access to protected content providers due t…
-
Medium 4.6
Buffer Over-read in BOOT
Denial of service while processing fastboot flash command on mmc due to buffer over read
-
Unscored —
Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation, aka Spectre-B…
-
Unscored —
A race condition was found in the Linux kernel's watch queue due to a missing lock in pipe_resize_ring(). The specific …
-
Unscored —
In messaging service, there is a missing permission check. This could lead to local denial of service in contacts servi…
-
Unscored —CVE-2023-20918 Public exploit
In getPendingIntentLaunchFlags of ActivityOptions.java, there is a possible elevation of privilege due to a confused de…
Revision history
-
#1
Initiale Fassung
References
-
Samsung Security Updates vom 2023-01-03
https://security.samsungmobile.com/securityUpdate.smsb
-
Pixel Update Bulletin January 2023 vom 2023-01-03
https://source.android.com/docs/security/bulletin/pixel/2023-01-01
-
Android Security Bulletin January 2023 vom 2023-01-03
https://source.android.com/docs/security/bulletin/2023-01-01