Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um seine Privilegien zu erhöhen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand zu verursachen.
Product
Das Android Betriebssystem von Google ist eine quelloffene Plattform für mobile Geräte. Die Basis bildet der Linux-Kernel.
Vulnerabilities 42
-
Critical 9.8
Buffer copy without checking size of input in WLAN Firmware
Memory corruption due to buffer copy without checking the size of input in WLAN Firmware while processing CCKM IE in reassoc response frame.
-
Critical 9.8
In onStart of BluetoothSwitchPreferenceController.java, there is a possible permission bypass due to a confused deputy.…
-
Critical 9.3
Buffer copy without checking size of input in Hypervisor
Memory corruption due to buffer copy without checking size of input while running memory sharing tests with large scattered memory.
-
High 8.4
Improper access control in Qualcomm IPC
Memory corruption due to improper access control in Qualcomm IPC.
-
High 8.4
Buffer copy without checking size of input in modem
Memory corruption in modem due to buffer copy without checking size of input while receiving WMI command.
-
High 8.2
Buffer over-read in WLAN
Information disclosure due to buffer over-read in WLAN while parsing NMF frame.
-
High 8.1CVE-2023-20938 Public exploit
In binder_transaction_buffer_release of binder.c, there is a possible use after free due to improper input validation. …
-
High 7.8
Configuration weakness in modem
Memory corruption due to configuration weakness in modem wile sending command to write protected files.
-
High 7.8
Integer overflow to buffer overflow in User Identity Module
Memory corruption in User Identity Module due to integer overflow to buffer overflow when a segement is received via qmi http.
-
High 7.8
An issue was discovered the x86 KVM subsystem in the Linux kernel before 5.18.17. Unprivileged guest users can compromi…
-
High 7.8CVE-2023-20933 Public exploit
In several functions of MediaCodec.cpp, there is a possible way to corrupt memory due to a use after free. This could l…
-
High 7.8
In resolveAttributionSource of ServiceUtilities.cpp, there is a possible way to disable the microphone privacy indicato…
-
High 7.8
In several functions of the Android Linux kernel, there is a possible way to corrupt memory due to a use after free. Th…
-
High 7.8
In multiple functions of looper_backed_event_loop.cpp, there is a possible way to corrupt memory due to improper lockin…
-
High 7.8
In the Android operating system, there is a possible way to replace a boot partition due to improperly used crypto. Thi…
-
High 7.8CVE-2023-20943 Public exploit
In clearApplicationUserData of ActivityManagerService.java, there is a possible way to remove system files due to a pat…
-
High 7.8CVE-2023-20944 Public exploit
In run of ChooseTypeAndAccountActivity.java, there is a possible escalation of privilege due to unsafe deserialization.…
-
High 7.8
In phNciNfc_MfCreateXchgDataHdr of phNxpExtns_MifareStd.cpp, there is a possible out of bounds write due to a missing b…
-
High 7.5
Buffer over-read in WLAN
Transient DOS due to buffer over-read in WLAN while processing an incoming management frame with incorrectly filled IEs.
-
High 7.5
Buffer over-read in WLAN Host
Transient DOS due to buffer over-read in WLAN Host while parsing frame information.
-
High 7.5
Improper input validation in WLAN Host
Transient DOS due to improper input validation in WLAN Host while parsing frame during defragmentation.
-
High 7.5
Improper input validation in WLAN Host
Transient DOS due to improper input validation in WLAN Host.
-
High 7.5
Buffer over-read in WLAN Firmware.
Transient DOS in WLAN Firmware due to buffer over-read while processing probe response or beacon.
-
High 7.5CVE-2022-43680 Public exploit
In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEnt…
-
High 7.5
In dropFramesUntilIframe of AAVCAssembler.cpp, there is a possible out of bounds read due to a heap buffer overflow. Th…
-
High 7.3
Access of uninitialized pointer in Bluetooth HOST
Memory corruption due to access of uninitialized pointer in Bluetooth HOST while processing the AVRCP packet.
-
High 7.0
mm/mremap.c in the Linux kernel before 5.13.3 has a use-after-free via a stale TLB because an rmap lock is not held dur…
-
Medium 6.8
Buffer over-read in Trusted Execution Environment
Information disclosure in Trusted Execution Environment due to buffer over-read while processing metadata verification requests.
-
Medium 6.7
In createTrack of AudioFlinger.cpp, there is a possible way to record audio without a privacy indicator due to a logic …
-
Medium 6.7
Memory corruption in camera due to improper validation of array index in Snapdragon Auto, Snapdragon Compute, Snapdrago…
-
Medium 6.7
Use after free in Trusted Application Environment
Memory corruption due to use after free in trusted application environment.
-
Medium 6.7
In cmd services, there is a OS command injection issue due to missing permission check. This could lead to local escala…
-
Medium 6.7
In ged, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of priv…
-
Medium 5.5
In addAutomaticZenRule of ZenModeHelper.java, there is a possible persistent denial of service due to resource exhausti…
-
Medium 5.5
In multiple files, there is a possible way to preserve WiFi settings due to residual data after a reset. This could lea…
-
Medium 5.5
In s2mpg11_pmic_probe of s2mpg11-regulator.c, there is a possible out of bounds read due to a heap buffer overflow. Thi…
-
Medium 4.7
In wlan driver, there is a race condition. This could lead to local denial of service in wlan services.
-
Low 3.3
In onCreatePreferences of EditInfoFragment.java, there is a possible way to read contacts belonging to other users due …
-
Unscored —
A vulnerability was found in linux kernel, where an information leak occurs via ext4_extent_header to userspace.
-
Unscored —
In hasInputInfo of Layer.cpp, there is a possible bypass of user interaction requirements due to a tapjacking/overlay a…
-
Unscored —
An issue was discovered in the Linux kernel before 5.19. In pxa3xx_gcu_write in drivers/video/fbdev/pxa3xx-gcu.c, the c…
-
Unscored —
In openMmapStream of AudioFlinger.cpp, there is a possible way to record audio without displaying the microphone privac…
Revision history
-
#6
Neue Updates von Ubuntu aufgenommen
-
#5
Neue Updates von Ubuntu aufgenommen
-
#4
Neue Updates von Ubuntu aufgenommen
-
#3
Neue Updates von Ubuntu aufgenommen
-
#2
Neue Updates von Ubuntu aufgenommen
-
#1
Initiale Fassung
References
-
Ubuntu Security Notice USN-6134-1 vom 2023-06-01
https://ubuntu.com/security/notices/USN-6134-1
-
Ubuntu Security Notice USN-6133-1 vom 2023-06-01
https://ubuntu.com/security/notices/USN-6133-1
-
Ubuntu Security Notice USN-5951-1 vom 2023-03-14
https://ubuntu.com/security/notices/USN-5951-1
-
Ubuntu Security Notice USN-5940-1 vom 2023-03-09
https://ubuntu.com/security/notices/USN-5940-1
-
Ubuntu Security Notice USN-5939-1 vom 2023-03-08
https://ubuntu.com/security/notices/USN-5939-1
-
Ubuntu Security Notice USN-5934-1 vom 2023-03-07
https://ubuntu.com/security/notices/USN-5934-1
-
Android Security Bulletin - February 2023 vom 2023-02-06
https://source.android.com/docs/security/bulletin/2023-02-01
-
Android Security Bulletin - February 2023 vom 2023-02-06
https://source.android.com/docs/security/bulletin/pixel/2023-02-01