Unscored CVE-2023-21283 EUVD-2023-25451GHSA-m3fr-4fp4-33cj

In multiple functions of StatusHints.java, there is a possible way to reveal images across users due to a confused deputy. This could lead …

Published Aug 14, 2023 · Updated Oct 9, 2024 · Assigned by google_android

Vendor: Google Product: Android Platform: Android

Description

In multiple functions of StatusHints.java, there is a possible way to reveal images across users due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.

Affected products

Vendor	Product	Affected	Fixed
Google	Android	13, 12L, 12, 11	—

Advisories 2

WID-SEC-2023-1984 Google Android: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 19, 2023
WID-SEC-2023-1981 Samsung Android: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 7, 2023

References

https://android.googlesource.com/platform/packages/services/Telecomm/+/9b41a963f352fdb3da1da8c633d45280badfcb24
https://android.googlesource.com/platform/frameworks/base/+/e17fd149c0a2bf6cce56ebfae3fa5364fead22cc
https://source.android.com/security/bulletin/2023-08-01