Summary
Ein Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode auszuführen, Informationen offenzulegen oder einen Denial of Service Zustand herbeizuführen.
Product
Das Android Betriebssystem ist eine quelloffene Plattform für mobile Geräte. Die Basis bildet der Linux-Kernel.
Vulnerabilities 52
-
High 8.8
libwebp: OOB write in BuildHuffmanTable
Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)
KEV Sep 13, 2023 -
Medium 5.5CVE-2023-4211 Exploited
Mali GPU Kernel Driver Allows Improper GPU Memory Processing Operations
A local non-privileged user can make improper GPU memory processing operations to gain access to already freed memory.
KEV Oct 3, 2023 -
Critical 9.8
Use of Out-of-range Pointer Offset in Modem
Memory corruption in Modem while processing security related configuration before AS Security Exchange.
-
Critical 9.8
Buffer Copy without Checking Size of Input in WLAN Firmware
Memory corruption in WLAN Firmware while doing a memory copy of pmk cache.
-
Critical 9.1
Improper Authentication in Data Modem
Cryptographic issue in Data Modem due to improper authentication during TLS handshake.
-
High 8.7
Improper Access Control in Kernel
Improper Access to the VM resource manager can lead to Memory Corruption.
-
High 8.4
Improper Access Control in Core
Memory Corruption in Core while invoking a call to Access Control core library with hardware protected address range.
-
High 8.4
Improper Input Validation in HLOS
Memory Corruption in HLOS while registering for key provisioning notify.
-
High 8.4
Use After Free in DSP Service
Memory corruption in DSP Service during a remote call from HLOS to DSP.
-
High 8.2
Buffer Over-read in Data Modem
Memory Corruption in Data Modem while making a MO call or MT VOLTE call.
-
High 8.2
Buffer Over-read in Data Modem
Information Disclosure in Data Modem while performing a VoLTE call with an undefined RTCP FB line value.
-
High 8.2
Buffer Over-read in Data Modem
Information Disclosure in data Modem while parsing an FMTP line in an SDP message.
-
High 7.8
In multiple functions of ActivityManagerService.java, there is a possible way to escape Google Play protection due to a…
-
High 7.8
Improper Validation of Array Index in HLOS
Memory Corruption in HLOS while importing a cryptographic key into KeyMaster Trusted Application.
-
High 7.8
Signed-to-unsigned conversion error in Audio
Memory corruption while parsing the ADSP response command.
-
High 7.8
Buffer Copy Without Checking Size of Input in Audio
Memory corruption while invoking callback function of AFE from ADSP.
-
High 7.8
In onTaskAppeared of PipTaskOrganizer.java, there is a possible way to bypass background activity launch restrictions d…
-
High 7.8
In resetSettingsLocked of SettingsProvider.java, there is a possible lockscreen bypass due to a permissions bypass. Thi…
-
High 7.8
In multiple locations, there is a possible way to bypass user notification of foreground services due to improper input…
-
High 7.8
In onCreate of ApnEditor.java, there is a possible way for a Guest user to change the APN due to a permission bypass. T…
-
High 7.8CVE-2023-40130 Public exploit
In notifyTimeout of CallRedirectionProcessor, there is a possible permission bypass due to a logic error in the code. T…
-
High 7.8
In android_view_InputDevice_create of android_view_InputDevice.cpp, there is a possible way to execute arbitrary code d…
-
High 7.5
Reachable Assertion in Modem
Transient DOS in Modem while triggering a camping on an 5G cell.
-
High 7.5
NULL pointer Dereference in Modem
Transient DOS in Modem while allocating DSM items.
-
High 7.5
In wlan firmware, there is a possible firmware assertion due to improper input handling. This could lead to remote deni…
-
High 7.5
Buffer over-read in WLAN Firmware
Transient DOS in WLAN Firmware while parsing a NAN management frame.
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS in WLAN Firmware while parsing rsn ies.
-
High 7.0
In GpuService of GpuService.cpp, there is a possible use after free due to a race condition. This could lead to local e…
-
Medium 6.7
In CDMA PPP protocol, there is a possible out of bounds write due to a missing bounds check. This could lead to remote …
-
Medium 6.7
In visitUris of Notification.java, there is a possible bypass of user profile boundaries due to a missing permission ch…
-
Medium 4.7
Mali GPU Kernel Driver Allows Improper GPU Memory Processing Operations
A local non-privileged user can make improper GPU processing operations to exploit a software race condition. If the system’s memory is carefully prepared by the user, then this in turn could give them access to already freed memory.
-
Medium 4.7
Mali GPU Kernel Driver Allows Improper GPU Memory Processing Operations
A local non-privileged user can make improper GPU processing operations to access a limited amount outside of buffer bounds or to exploit a software race condition. If the system’s memory is carefully prepared by the user, then this in turn could give them ac…
-
Unscored —
Arm Mali GPU Kernel Driver (Midgard r26p0 through r30p0, Bifrost r0p0 through r34p0, and Valhall r19p0 through r34p0) a…
-
Unscored —
Arm Mali GPU Kernel Driver (Midgard r4p0 through r31p0, Bifrost r0p0 through r36p0 before r37p0, and Valhall r19p0 thro…
-
Unscored —
In validatePassword of WifiConfigurationUtil.java, there is a possible way to get the device into a boot loop due to im…
-
Unscored —
In multiple locations, there is a possible way to crash multiple system services due to resource exhaustion. This could…
-
Unscored —
In visitUris of Notification.java, there is a possible way to reveal image contents from another user due to a missing …
-
Unscored —
In display, there is a possible information disclosure due to a missing bounds check. This could lead to local informat…
-
Unscored —
In appendEscapedSQLString of DatabaseUtils.java, there is a possible SQL injection due to unsafe deserialization. This …
-
Unscored —
In updateActionViews of PipMenuView.java, there is a possible bypass of a multi user security boundary due to a confuse…
-
Unscored —CVE-2023-40127 Public exploit
In multiple locations, there is a possible way to access screenshots due to a confused deputy. This could lead to local…
-
Unscored —
In several functions of xmlregexp.c, there is a possible out of bounds write due to a heap buffer overflow. This could …
-
Unscored —
In build_read_multi_rsp of gatt_sr.cc, there is a possible out of bounds write due to a heap buffer overflow. This coul…
-
Unscored —CVE-2023-40133 Public exploit
In multiple locations of DialogFillUi.java, there is a possible way to view another user's images due to a confused dep…
-
Unscored —
In isFullScreen of FillUi.java, there is a possible way to view another user's images due to a confused deputy. This co…
-
Unscored —
In applyCustomDescription of SaveUi.java, there is a possible way to view another user's images due to a confused deput…
-
Unscored —
In setHeader of DialogFillUi.java, there is a possible way to view another user's images due to a confused deputy. This…
-
Unscored —
In multiple functions of DialogFillUi.java, there is a possible way to view another user's images due to a confused dep…
-
Unscored —
In FillUi of FillUi.java, there is a possible way to view another user's images due to a confused deputy. This could le…
-
Unscored —
In FillUi of FillUi.java, there is a possible way to view another user's images due to a confused deputy. This could le…
-
Unscored —
In Telecom service, there is a possible missing permission check. This could lead to local denial of service with Syste…
-
Unscored —CVE-2023-5129 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Duplicate of CVE-2023-4863.
Revision history
-
#1
Initiale Fassung
References
-
Android Patchday Oktober 2023 vom 2023-10-03
https://source.android.com/docs/security/bulletin/2023-10-01