Summary
Ein Angreifer kann mehrere Schwachstellen in Samsung Android ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen und seine Rechte zu erweitern.
Product
Das Android Betriebssystem ist eine quelloffene Plattform für mobile Geräte. Die Basis bildet der Linux-Kernel.
Vulnerabilities 40
-
Critical 9.8
Improper Restriction of Operations within the Bounds of a Memory Buffer in WLAN Firmware
Memory corruption in WLAN Firmware while parsing receieved GTK Keys in GTK KDE.
-
High 8.5
Improper input validation vulnerability in Duo prior to SMR Oct-2023 Release 1 allows local attackers to launch privile…
-
High 8.5
Improper input validation vulnerability in Evaluator prior to SMR Oct-2023 Release 1 allows local attackers to launch p…
-
High 8.4
Use After Free in Graphics
Memory corruption in Graphics while processing user packets for command submission.
-
High 7.8
In multiple functions of ActivityManagerService.java, there is a possible way to escape Google Play protection due to a…
-
High 7.8
Improper Restriction of Operations within the Bounds of a Memory Buffer in WLAN HAL
Memory corruption in WLAN HAL while parsing Rx buffer in processing TLV payload.
-
High 7.8
Improper Validation of Array Index in WLAN HAL
Memory corruption in WLAN HAL while parsing WMI command parameters.
-
High 7.8
Stack-based Buffer Overflow in vulnerability HDCP trustlet prior to SMR Oct-2023 Release 1 allows local privileged atta…
-
High 7.8
In onTaskAppeared of PipTaskOrganizer.java, there is a possible way to bypass background activity launch restrictions d…
-
High 7.8
In resetSettingsLocked of SettingsProvider.java, there is a possible lockscreen bypass due to a permissions bypass. Thi…
-
High 7.8
In multiple locations, there is a possible way to bypass user notification of foreground services due to improper input…
-
High 7.8
In onCreate of ApnEditor.java, there is a possible way for a Guest user to change the APN due to a permission bypass. T…
-
High 7.8CVE-2023-40130 Public exploit
In notifyTimeout of CallRedirectionProcessor, there is a possible permission bypass due to a logic error in the code. T…
-
High 7.8
In android_view_InputDevice_create of android_view_InputDevice.cpp, there is a possible way to execute arbitrary code d…
-
High 7.5
Reachable Assertion in Modem
Transient DOS in Modem while processing invalid System Information Block 1.
-
High 7.5
Reachable Assertion in Modem
Transient DOS in Modem while processing RRC reconfiguration message.
-
High 7.5
Improper Authorization in WLAN Host
Transient DOS in WLAN Host when a mobile station receives invalid channel in CSA IE while doing channel switch announcement (CSA).
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS in WLAN Firmware while interpreting MBSSID IE of a received beacon frame.
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS in WLAN firmware while parsing MLO (multi-link operation).
-
High 7.5
Improper Authorization in WLAN Host
Transient DOS in WLAN Host while doing channel switch announcement (CSA), when a mobile station receives invalid channel in CSA IE.
-
High 7.0
In GpuService of GpuService.cpp, there is a possible use after free due to a race condition. This could lead to local e…
-
Medium 6.7
In visitUris of Notification.java, there is a possible bypass of user profile boundaries due to a missing permission ch…
-
Medium 6.7
Improper access control vulnerability in SecSettings prior to SMR Oct-2023 Release 1 allows attackers to enable Wi-Fi a…
-
Medium 5.7
Logic error in package installation via debugger command prior to SMR Oct-2023 Release 1 allows physical attacker to in…
-
Medium 5.5
Improper access control in system property prior to SMR Oct-2023 Release 1 allows local attacker to get CPU serial numb…
-
Unscored —
In validatePassword of WifiConfigurationUtil.java, there is a possible way to get the device into a boot loop due to im…
-
Unscored —
In multiple locations, there is a possible way to crash multiple system services due to resource exhaustion. This could…
-
Unscored —
In visitUris of Notification.java, there is a possible way to reveal image contents from another user due to a missing …
-
Unscored —
In appendEscapedSQLString of DatabaseUtils.java, there is a possible SQL injection due to unsafe deserialization. This …
-
Unscored —
In updateActionViews of PipMenuView.java, there is a possible bypass of a multi user security boundary due to a confuse…
-
Unscored —CVE-2023-40127 Public exploit
In multiple locations, there is a possible way to access screenshots due to a confused deputy. This could lead to local…
-
Unscored —
In several functions of xmlregexp.c, there is a possible out of bounds write due to a heap buffer overflow. This could …
-
Unscored —
In build_read_multi_rsp of gatt_sr.cc, there is a possible out of bounds write due to a heap buffer overflow. This coul…
-
Unscored —CVE-2023-40133 Public exploit
In multiple locations of DialogFillUi.java, there is a possible way to view another user's images due to a confused dep…
-
Unscored —
In isFullScreen of FillUi.java, there is a possible way to view another user's images due to a confused deputy. This co…
-
Unscored —
In applyCustomDescription of SaveUi.java, there is a possible way to view another user's images due to a confused deput…
-
Unscored —
In setHeader of DialogFillUi.java, there is a possible way to view another user's images due to a confused deputy. This…
-
Unscored —
In multiple functions of DialogFillUi.java, there is a possible way to view another user's images due to a confused dep…
-
Unscored —
In FillUi of FillUi.java, there is a possible way to view another user's images due to a confused deputy. This could le…
-
Unscored —
In FillUi of FillUi.java, there is a possible way to view another user's images due to a confused deputy. This could le…
Revision history
-
#1
Initiale Fassung
References
-
Samsung Security Advisory - SMR-OCT-2023 vom 2023-10-03
https://security.samsungmobile.com/securityUpdate.smsb