Unscored CVE-2023-35665 EUVD-2023-39665GHSA-cw2p-j4hm-rrp2

In multiple files, there is a possible way to import a contact from another user due to a missing permission check. This could lead to loca…

Published Sep 11, 2023 · Updated Sep 26, 2024 · Assigned by google_android

Vendor: Google Product: Android Platform: Android

Description

In multiple files, there is a possible way to import a contact from another user due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected products

Vendor	Product	Affected	Fixed
Google	Android	13, 12L, 12, 11	—

Advisories 1

WID-SEC-2023-2273 Google Android: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 5, 2023

References

https://android.googlesource.com/platform/packages/services/Telephony/+/674039e70e1c5bf29b808899ac80c709acc82290
https://source.android.com/security/bulletin/2023-09-01