Unscored CVE-2023-21277 EUVD-2023-25445GHSA-4cqq-xcjq-jggc

In visitUris of RemoteViews.java, there is a possible way to reveal images across users due to a missing permission check. This could lead …

Published Aug 14, 2023 · Updated Oct 9, 2024 · Assigned by google_android

Vendor: Google Product: Android Platform: Android

Description

In visitUris of RemoteViews.java, there is a possible way to reveal images across users due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.

Affected products

Vendor	Product	Affected	Fixed
Google	Android	13, 12L, 12	—

Advisories 2

WID-SEC-2023-1984 Google Android: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 19, 2023
WID-SEC-2023-1981 Samsung Android: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 7, 2023

References

https://android.googlesource.com/platform/frameworks/base/+/9b58aee2a4528c60b0aa2540bd0f48d2871d2dc7
https://source.android.com/security/bulletin/2023-08-01