Summary
Ein Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder seine Rechte zu erweitern.
Product
Das Android Betriebssystem ist eine quelloffene Plattform für mobile Geräte. Die Basis bildet der Linux-Kernel.
Vulnerabilities 45
-
Critical 9.8
Use of Out-of-range Pointer Offset in Multi-mode Call Processor
Memory Corruption in Multi-mode Call Processor while processing bit mask API.
-
Critical 9.8
Buffer Copy Without Checking Size of Input in WLAN Firmware
Memory corruption in WLAN Firmware while parsing a NAN management frame carrying a S3 attribute.
-
Critical 9.8
In readLogs of StatsService.cpp, there is a possible memory corruption due to a use after free. This could lead to loca…
-
Critical 9.3
Improper Input Validation in Core
Memory Corruption in Core during syscall for Sectools Fuse comparison feature.
-
Critical 9.0
Improper Input Validation in Core
Memory corruption in core services when Diag handler receives a command to configure event listeners.
-
High 8.4
Improper Authentication in Core
Memory Corruption in Core due to secure memory access by user while loading modem image.
-
High 8.4
Use After Free in Audio
Memory corruption in Audio when SSR event is triggered after music playback is stopped.
-
High 8.4
In discovery_thread of Dns64Configuration.cpp, there is a possible memory corruption due to a use after free. This coul…
-
High 8.4
In multiple functions of MtpFfsHandle.cpp , there is a possible out of bounds write due to a use after free. This could…
-
High 8.2
Improper Restriction of Operations within the Bounds of a Memory Buffer in TZ Secure OS
Memory corruption in TZ Secure OS while loading an app ELF.
-
High 7.8
In video, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of…
-
High 7.8
Buffer Copy Without Checking Size of Input in Automotive Audio
Memory corruption in Automotive Audio while copying data from ADSP shared buffer to the VOC packet data buffer.
-
High 7.8
Buffer Copy Without Checking Size of Input in Audio
Memory Corruption in Audio while invoking callback function in driver from ADSP.
-
High 7.8
Buffer Copy Without Checking Size of Input in Audio
Memory corruption in Audio while processing the VOC packet data from ADSP.
-
High 7.8
In sanitizeSbn of NotificationManagerService.java, there is a possible way to launch an activity from the background du…
-
High 7.8
In setMediaButtonReceiver of MediaSessionRecord.java, there is a possible way to send a pending intent on behalf of sys…
-
High 7.5
In 5G NRLC, there is a possible invalid memory access due to lack of error handling. This could lead to remote denial o…
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS in WLAN Firmware while parsing no-inherit IES.
-
High 7.5
Buffer over-read in WLAN Firmware
Transient DOS in WLAN Firmware while parsing t2lm buffers.
-
High 7.5
NULL Pointer dereference in WLAN Firmware
Transient DOS in WLAN Firmware when firmware receives beacon including T2LM IE.
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS in WLAN Firmware while parsing WLAN beacon or probe-response frame.
-
High 7.5
In ca-certificates, there is a possible way to read encrypted TLS data due to untrusted cryptographic certificates. Thi…
-
High 7.4
In ARTPWriter of ARTPWriter.cpp, there is a possible use after free due to uninitialized data. This could lead to local…
-
High 7.3CVE-2023-40109 Public exploit
In createFromParcel of UsbConfiguration.java, there is a possible background activity launch (BAL) due to a permissions…
-
High 7.1
Improper Authorization in HLOS
Cryptographic issue in HLOS during key management.
-
High 7.0
In video, there is a possible memory corruption due to a race condition. This could lead to local escalation of privile…
-
Medium 6.7
Buffer Copy without Checking Size of Input in Audio
Memory corruption while processing audio effects.
-
Medium 6.7
In secmem, there is a possible memory corruption due to type confusion. This could lead to local escalation of privileg…
-
Medium 6.7
In keyinstall, there is a possible memory corruption due to type confusion. This could lead to local escalation of priv…
-
Medium 6.7
In display, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of …
-
Medium 6.6
Buffer Over-read in WLAN HOST
Memory corruption in WLAN HOST while processing the WLAN scan descriptor list.
-
Medium 6.2
In several functions of PhoneAccountRegistrar.java, there is a possible way to prevent an access to emergency services …
-
Medium 6.2
In multiple functions of MtpPacket.cpp, there is a possible out of bounds write due to a heap buffer overflow. This cou…
-
Medium 6.1
Buffer Over-read in WLAN Host
Information Disclosure in WLAN Host when processing WMI event command.
-
Medium 6.1
Buffer Over-read in Qualcomm IPC
Information Disclosure in Qualcomm IPC while reading values from shared memory in VM.
-
Medium 6.1
Buffer Over-read in IOE Firmware
Information disclosure in IOE Firmware while handling WMI command.
-
Medium 6.1
Buffer Over-read in WLAN HAL
Information disclosure in WLAN HAL while handling the WMI state info command.
-
Medium 6.1
Buffer Over-read in WLAN HAL
Information disclosure in WLAN HAL when reception status handler is called.
-
Medium 6.1
Buffer Over-read in WLAN HAL
Information disclosure in WLAN HAL while handling command through WMI interfaces.
-
Medium 5.5
In registerPhoneAccount of PhoneAccountRegistrar.java, uncaught exceptions in parsing persisted user data could lead to…
-
Medium 5.5
An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU processing opera…
-
Medium 5.5
In backupAgentCreated of ActivityManagerService.java, there is a possible way to leak sensitive data due to a missing p…
-
Medium 5.5
In multiple locations, there is a possible way for apps to access cross-user message data due to a missing permission c…
-
Medium 5.5
In multiple locations, there is a possible cross-user read due to a confused deputy. This could lead to local informati…
-
Medium 5.1
In ippSetValueTag of ipp.c, there is a possible out of bounds read due to a missing bounds check. This could lead to lo…
Revision history
-
#1
Initiale Fassung
References
-
Pixel Update Bulletin—November 2023 vom 2023-11-06
https://source.android.com/docs/security/bulletin/pixel/2023-11-01
-
Android Security Bulletin—November 2023 vom 2023-11-06
https://source.android.com/docs/security/bulletin/2023-11-01