Summary
Ein entfernter anonymer Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um seine Privilegien zu erweitern, einen Denial-of-Service-Zustand zu verursachen, vertrauliche Informationen offenzulegen und beliebigen Code auszuführen.
Product
Das Android Betriebssystem ist eine quelloffene Plattform für mobile Geräte. Die Basis bildet der Linux-Kernel.
Vulnerabilities 32
-
High 8.8
In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the co…
KEV Sep 13, 2023 -
Critical 9.8
Improper Restriction of Operations within the Bounds of a Memory Buffer in WLAN Firmware
Memory corruption in WLAN Firmware while parsing receieved GTK Keys in GTK KDE.
-
High 8.4
Improper Validation of Array Index in Audio
Memory corruption due to improper validation of array index in Audio.
-
High 8.4
Stack-based Buffer Overflow in WIN Product
Memory corruption in WIN Product while invoking WinAcpi update driver in the UEFI region.
-
High 8.4
Use After Free in Graphics
Memory corruption in Graphics while processing user packets for command submission.
-
High 7.8
Improper Restriction of Operations within the Bounds of a Memory Buffer in WLAN HAL
Memory corruption in WLAN HAL while parsing Rx buffer in processing TLV payload.
-
High 7.8
Improper Validation of Array Index in WLAN HAL
Memory corruption in WLAN HAL while parsing WMI command parameters.
-
High 7.8
In computeValuesFromData of FileUtils.java, there is a possible way to insert files to other apps' external private dir…
-
High 7.8
In hasPermissionForActivity of PackageManagerHelper.java, there is a possible way to start arbitrary components due to …
-
High 7.5
Reachable Assertion in Modem
Transient DOS in Modem while processing invalid System Information Block 1.
-
High 7.5
Reachable Assertion in Modem
Transient DOS in Modem while processing RRC reconfiguration message.
-
High 7.5
Improper Authorization in WLAN Host
Transient DOS in WLAN Host when a mobile station receives invalid channel in CSA IE while doing channel switch announcement (CSA).
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS in WLAN Firmware while interpreting MBSSID IE of a received beacon frame.
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS in WLAN firmware while parsing MLO (multi-link operation).
-
High 7.5
Improper Authorization in WLAN Host
Transient DOS in WLAN Host while doing channel switch announcement (CSA), when a mobile station receives invalid channel in CSA IE.
-
Unscored —
In gatt_process_prep_write_rsp of gatt_cl.cc, there is a possible privilege escalation due to a use after free. This co…
-
Unscored —
In convertSubgraphFromHAL of ShimConverter.cpp, there is a possible out of bounds read due to a missing bounds check. T…
-
Unscored —
In multiple files, there is a possible way to import a contact from another user due to a missing permission check. Thi…
-
Unscored —
In bta_av_rc_msg of bta_av_act.cc, there is a possible use after free due to a logic error in the code. This could lead…
-
Unscored —
In updateList of NotificationAccessSettings.java, there is a possible way to hide approved notification listeners in th…
-
Unscored —
In checkKeyIntentParceledCorrectly of AccountManagerService.java, there is a possible way to control other running acti…
-
Unscored —CVE-2023-35671 Public exploit
In onHostEmulationData of HostEmulationManager.java, there is a possible way for a general purpose NFC reader to read t…
-
Unscored —
In build_read_multi_rsp of gatt_sr.cc, there is a possible out of bounds write due to an integer overflow. This could l…
-
Unscored —
In loadMediaResumptionControls of MediaResumeListener.kt, there is a possible way to play and listen to media files pla…
-
Unscored —
In createQuickShareAction of SaveImageInBackgroundTask.java, there is a possible way to trigger a background activity l…
-
Unscored —
In onCreate of DeviceAdminAdd.java, there is a possible way to forcibly add a device admin due to a missing permission …
-
Unscored —
In MtpPropertyValue of MtpProperty.h, there is a possible out of bounds read due to uninitialized data. This could lead…
-
Unscored —
In multiple locations, there is a possible way to import contacts belonging to other users due to a confused deputy. Th…
-
Unscored —
In eatt_l2cap_reconfig_completed of eatt_impl.h, there is a possible out of bounds write due to an integer overflow. Th…
-
Unscored —
In bindSelection of DatabaseUtils.java, there is a possible way to access files from other applications due to SQL inje…
-
Unscored —
In avdt_msg_asmbl of avdt_msg.cc, there is a possible out of bounds write due to an integer overflow. This could lead t…
-
Unscored —CVE-2023-35687 Public exploit
In MtpPropertyValue of MtpProperty.h, there is a possible memory corruption due to a use after free. This could lead to…
Revision history
-
#1
Initiale Fassung
References
-
Android Security Bulletin vom 2023-09-05
https://source.android.com/docs/security/bulletin/2023-09-01