Patch days / December 2023

Android Security Bulletin — December 2023

Monday, 4 December 2023

Vulnerabilities: 47
Critical: 3
High: 1
Zero-days: 0
Public exploit: 3

Exploited 0

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

None of this release's vulnerabilities is known to be exploited so far.

Critical 3

Critical 9.8
CVE-2023-21166 In RGXBackingZSBuffer of rgxta3d.c, there is a possible arbitrary code execution due to a use after free. This could lead to local escalation of privilege in t…
Critical 9.8
CVE-2023-21216 In PMRChangeSparseMemOSMem of physmem_osmem_linux.c, there is a possible arbitrary code execution due to a use after free. This could lead to local escalation …
Critical 9.8
CVE-2023-40077 In multiple functions of MetaDataBase.cpp, there is a possible UAF write due to a race condition. This could lead to remote escalation of privilege with no add…
EPSS 8.4%

Public exploit code 3

Not critical and not yet seen exploited, but exploit or proof-of-concept code is public.

All vulnerabilities 47

Critical3 Show

High1 Show

High 8.8
CVE-2023-40088 In callback_thread_event of com_android_bluetooth_btservice_AdapterService.cpp, there is a possible memory corruption due to a use after free. This could lead …
EPSS 1.7%

Medium1 Show

Medium 5.5
CVE-2023-40076 In createPendingIntent of CredentialManagerUi.java, there is a possible way to access credentials from other users due to a permissions bypass. This could lead…
EPSS 2.3%

Unscored42 Show