Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Samsung Android ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen, seine Privilegien zu erweitern, Informationen offenzulegen oder einen Denial of Service Zustand herbeizuführen.
Product
Das Android Betriebssystem ist eine quelloffene Plattform für mobile Geräte. Die Basis bildet der Linux-Kernel.
Vulnerabilities 55
-
Critical 9.6CVE-2023-2136 Exploited
Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the ren…
KEV Apr 21, 2023 -
High 7.8
Arm Mali GPU Kernel Driver allows a non-privileged user to achieve write access to read-only memory pages. This affects…
KEV Mar 30, 2023 -
Critical 9.3
Time-of-check time-of-use race condition in Core
Memory corruption in Core due to time-of-check time-of-use race condition during dump collection in trust zone.
-
High 8.4
Stack-based buffer overflow in Core
Memory corruption in Core due to stack-based buffer overflow.
-
High 8.4
Stack based buffer overflow in Core
Memory corruption in core due to stack-based buffer overflow
-
High 8.4
Stack based buffer overflow in Core
Memory corruption due to stack-based buffer overflow in Core
-
High 8.4
Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN HAL
Memory corruption in WLAN HAL while processing WMI-UTF command or FTM TLV1 command.
-
High 7.9
Stack-based buffer overflow in Modem
Memory corruption in modem due to stack based buffer overflow while parsing OTASP Key Generation Request Message.
-
High 7.8
Use after free in Qualcomm IPC
Memory corruption in Qualcomm IPC due to use after free while receiving the incoming packet and reposting it.
-
High 7.8
In dialer service, there is a possible missing permission check. This could lead to local escalation of privilege with …
-
High 7.8
In showNextSecurityScreenOrFinish of KeyguardSecurityContainerController.java, there is a possible way to access the lo…
-
High 7.8
Improper Input Validation in WLAN HOST
Memory corruption in WLAN HOST while receiving an WMI event from firmware.
-
High 7.8
Improper Input Validation in Audio
Memoru corruption in Audio when ADSP sends input during record use case.
-
High 7.8
Improper Access control in GPU Subsystem
Memory Corruption in GPU Subsystem due to arbitrary command execution from GPU in privileged mode.
-
High 7.5
Reachable Assertion in Modem
Assertion occurs while processing Reconfiguration message due to improper validation
-
High 7.5
Reachable assertion in Modem
Transient DOS due to reachable assertion in Modem because of invalid network configuration.
-
High 7.5
Improper authorization in Modem
Transient DOS due to improper authorization in Modem
-
High 7.5
Improper authentication in Modem
Transient DOS due to improper authentication in modem while receiving plain TLB OTA request message from network.
-
High 7.5
Reachable assertion in Modem
Transient DOS due to reachable assertion in modem while processing sib with incorrect values from network.
-
High 7.5
Buffer Over-Read in WLAN Firmware
Transient DOS in WLAN Firmware while processing the received beacon or probe response frame.
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS in WLAN Firmware while processing frames with missing header fields.
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS while parsing WLAN beacon or probe-response frame.
-
High 7.3
In telephony service, there is a possible missing permission check. This could lead to local escalation of privilege wi…
-
High 7.3
In cp_dump driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local deni…
-
High 7.1
Information exposure in Kernel
Information disclosure in Kernel due to indirect branch misprediction.
-
High 7.1
Improper access control in Kernel
Memory corruption due to improper access control in kernel while processing a mapping request from root process.
-
Medium 6.2
Untrusted Pointer Dereference in Core
Transient DOS due to untrusted Pointer Dereference in core while sending USB QMI request.
-
Medium 5.5
In telephony service, there is a possible missing permission check. This could lead to local denial of service with no …
-
Medium 5.5
In add of WifiNetworkSuggestionsManager.java, there is a possible way to trigger permanent DoS due to resource exhausti…
-
Medium 5.5
In PreferencesHelper.java, an uncaught exception may cause the device to get stuck in a boot loop. This could lead to l…
-
Low 3.3
An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU memory processin…
-
Unscored —
In PVRSRVBridgeSyncPrimOpCreate of the PowerVR kernel driver, a missing size check means there is a possible integer ov…
-
Unscored —
In _PMRCreate of the PowerVR kernel driver, a missing bounds check means it is possible to overwrite heap memory via Ph…
-
Unscored —
Arm Mali GPU Kernel Driver has a use-after-free: Midgard r28p0 through r29p0 before r30p0, Bifrost r17p0 through r23p0 …
-
Unscored —CVE-2023-20918 Public exploit
In getPendingIntentLaunchFlags of ActivityOptions.java, there is a possible elevation of privilege due to a confused de…
-
Unscored —
In openMmapStream of AudioFlinger.cpp, there is a possible way to record audio without displaying the microphone privac…
-
Unscored —
In multiple functions of WVDrmPlugin.cpp, there is a possible use after free due to a race condition. This could lead t…
-
Unscored —
In multiple functions of cdm_engine.cpp, there is a possible use-after-free due to improper locking. This could lead to…
-
Unscored —
In updatePictureInPictureMode of ActivityRecord.java, there is a possible bypass of background launch restrictions due …
-
Unscored —CVE-2023-21238 Public exploit
In visitUris of RemoteViews.java, there is a possible leak of images between users due to a confused deputy. This could…
-
Unscored —
In visitUris of Notification.java, there is a possible way to leak image data across user boundaries due to a confused …
-
Unscored —
In Policy of Policy.java, there is a possible boot loop due to resource exhaustion. This could lead to local denial of …
-
Unscored —
In rw_i93_send_to_upper of rw_i93.cc, there is a possible out of bounds write due to an integer overflow. This could le…
-
Unscored —
In validateForCommonR1andR2 of PasspointConfiguration.java, there is a possible way to inflate the size of a config fil…
-
Unscored —CVE-2023-21246 Public exploit
In ShortcutInfo of ShortcutInfo.java, there is a possible way for an app to retain notification listening access due to…
-
Unscored —
In getAvailabilityStatus of BluetoothScanningMainSwitchPreferenceController.java, there is a possible way to bypass a d…
-
Unscored —
In getAvailabilityStatus of WifiScanningMainSwitchPreferenceController.java, there is a possible way to bypass a device…
-
Unscored —
In multiple functions of OneTimePermissionUserManager.java, there is a possible one-time permission retention due to a …
-
Unscored —
In gatt_end_operation of gatt_utils.cc, there is a possible out of bounds write due to a missing bounds check. This cou…
-
Unscored —CVE-2023-21251 Public exploit
In onCreate of ConfirmDialog.java, there is a possible way to connect to VNP bypassing user's consent due to improper i…
-
Unscored —
In getCurrentState of OneTimePermissionUserManager.java, there is a possible way to hold one-time permissions after the…
-
Unscored —
In SettingsHomepageActivity.java, there is a possible way to launch arbitrary activities via Settings due to a logic er…
-
Unscored —
In updateSettingsInternalLI of InstallPackageHelper.java, there is a possible way to sideload an app in the work profil…
-
Unscored —CVE-2023-21261 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
In startInput of AudioPolicyInterfaceImpl.cpp, there is a possible way of erroneously displaying the microphone privacy…
Revision history
-
#1
Initiale Fassung
References
-
Samsung Security Advisory vom 2023-07-05
https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=07