Summary
Ein Angreifer kann mehrere Schwachstellen in Samsung Android ausnutzen, um beliebigen Code auszuführen, vertrauliche Informationen offenzulegen oder Sicherheitsmaßnahmen zu umgehen.
Product
Das Android Betriebssystem ist eine quelloffene Plattform für mobile Geräte. Die Basis bildet der Linux-Kernel.
Vulnerabilities 51
-
Critical 9.8
Use of Out-of-range Pointer Offset in Multi-mode Call Processor
Memory Corruption in Multi-mode Call Processor while processing bit mask API.
-
Critical 9.8
Buffer Copy Without Checking Size of Input in WLAN Firmware
Memory corruption in WLAN Firmware while parsing a NAN management frame carrying a S3 attribute.
-
Critical 9.8
In multiple functions of MetaDataBase.cpp, there is a possible UAF write due to a race condition. This could lead to re…
-
Critical 9.3
Improper Input Validation in Core
Memory Corruption in Core during syscall for Sectools Fuse comparison feature.
-
Critical 9.0
Improper Input Validation in Core
Memory corruption in core services when Diag handler receives a command to configure event listeners.
-
High 8.8
In callback_thread_event of com_android_bluetooth_btservice_AdapterService.cpp, there is a possible memory corruption d…
-
High 8.4
Improper Authentication in Core
Memory Corruption in Core due to secure memory access by user while loading modem image.
-
High 8.4
Use After Free in Audio
Memory corruption in Audio when SSR event is triggered after music playback is stopped.
-
High 8.2
Improper Restriction of Operations within the Bounds of a Memory Buffer in TZ Secure OS
Memory corruption in TZ Secure OS while loading an app ELF.
-
High 7.8
Buffer Copy Without Checking Size of Input in Automotive Audio
Memory corruption in Automotive Audio while copying data from ADSP shared buffer to the VOC packet data buffer.
-
High 7.8
Buffer Copy Without Checking Size of Input in Audio
Memory Corruption in Audio while invoking callback function in driver from ADSP.
-
High 7.8
Buffer Copy Without Checking Size of Input in Audio
Memory corruption in Audio while processing the VOC packet data from ADSP.
-
High 7.5
In 5G NRLC, there is a possible invalid memory access due to lack of error handling. This could lead to remote denial o…
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS in WLAN Firmware while parsing no-inherit IES.
-
High 7.5
Buffer over-read in WLAN Firmware
Transient DOS in WLAN Firmware while parsing t2lm buffers.
-
High 7.5
NULL Pointer dereference in WLAN Firmware
Transient DOS in WLAN Firmware when firmware receives beacon including T2LM IE.
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS in WLAN Firmware while parsing WLAN beacon or probe-response frame.
-
High 7.1
Improper Authorization in HLOS
Cryptographic issue in HLOS during key management.
-
Medium 6.7
In secmem, there is a possible memory corruption due to type confusion. This could lead to local escalation of privileg…
-
Medium 6.7
In keyinstall, there is a possible memory corruption due to type confusion. This could lead to local escalation of priv…
-
Medium 5.5
An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU processing opera…
-
Medium 5.5
In createPendingIntent of CredentialManagerUi.java, there is a possible way to access credentials from other users due …
-
Unscored —
In multiple functions of KeyguardViewMediator.java, there is a possible way to bypass lockdown mode with screen pinning…
-
Unscored —
In registerPhoneAccount of TelecomServiceImpl.java, there is a possible way to reveal images from another user due to a…
-
Unscored —
In visitUris of Notification.java, there is a possible way to display images from another user due to a confused deputy…
-
Unscored —
In visitUris of Notification.java, there is a possible cross-user media read due to Confused Deputy. This could lead to…
-
Unscored —
In saveToXml of PersistableBundle.java, invalid data could lead to local persistent denial of service with no additiona…
-
Unscored —
In forceReplaceShortcutInner of ShortcutPackage.java, there is a possible way to register unlimited packages due to a m…
-
Unscored —
In a2dp_vendor_opus_decoder_decode_packet of a2dp_vendor_opus_decoder.cc, there is a possible out of bounds write due t…
-
Unscored —
In injectSendIntentSender of ShortcutService.java, there is a possible background activity launch due to a permissions …
-
Unscored —
In multiple functions of btm_ble_gap.cc, there is a possible out of bounds write due to a logic error in the code. This…
-
Unscored —
In modify_for_next_stage of fdt.rs, there is a possible way to render KASLR ineffective due to improperly used crypto. …
-
Unscored —
In parse_gap_data of utils.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to…
-
Unscored —CVE-2023-40084 Public exploit
In run of MDnsSdListener.cpp, there is a possible memory corruption due to a use after free. This could lead to local e…
-
Unscored —
In transcodeQ*ToFloat of btif_avrcp_audio_track.cc, there is a possible out of bounds write due to a missing bounds che…
-
Unscored —
In getCredentialManagerPolicy of DevicePolicyManagerService.java, there is a possible method for users to select creden…
-
Unscored —
In BTM_BleVerifySignature of btm_ble.cc, there is a possible way to bypass signature validation due to side channel inf…
-
Unscored —
In onTransact of IncidentService.cpp, there is a possible out of bounds write due to memory corruption. This could lead…
-
Unscored —
In verifyShortcutInfoPackage of ShortcutService.java, there is a possible way to see another user's image due to a conf…
-
Unscored —
In keyguardGoingAway of ActivityTaskManagerService.java, there is a possible lock screen bypass due to a missing permis…
-
Unscored —
In createDontSendToRestrictedAppsBundle of PendingIntentUtils.java, there is a possible background activity launch due …
-
Unscored —
In OpRecordAudioMonitor::onFirstRef of AudioRecordClient.cpp, there is a possible way to record audio from the backgrou…
-
Unscored —
In hasPermissionForActivity of PackageManagerHelper.java, there is a possible URI grant due to improper input validatio…
-
Unscored —
In mOnDone of NotificationConversationInfo.java, there is a possible way to access app notification data of another use…
-
Unscored —
In multiple locations, there is a possible way to corrupt memory due to a double free. This could lead to local escalat…
-
Unscored —
In multiple functions of btm_ble_gap.cc, there is a possible out of bounds write due to a missing bounds check. This co…
-
Unscored —
In fixUpIncomingShortcutInfo of ShortcutService.java, there is a possible way to view another user's image due to a con…
-
Unscored —
In CreateAudioBroadcast of broadcaster.cc, there is a possible out of bounds write due to a missing bounds check. This …
-
Unscored —
In CreateAudioBroadcast of broadcaster.cc, there is a possible out of bounds write due to a missing bounds check. This …
-
Unscored —CVE-2023-45777 Public exploit
In checkKeyIntentParceledCorrectly of AccountManagerService.java, there is a possible way to launch arbitrary activitie…
-
Unscored —
In parse_gap_data of utils.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to…
Revision history
-
#1
Initiale Fassung
References
-
Samsung Security Updates vom 2023-12-04
https://security.samsungmobile.com/securityUpdate.smsb