Unscored CVE-2023-40121 EUVD-2023-44728GHSA-vvc5-h94x-p72m

In appendEscapedSQLString of DatabaseUtils.java, there is a possible SQL injection due to unsafe deserialization. This could lead to local …

Published Oct 27, 2023 · Updated Sep 9, 2024 · Assigned by google_android

Vendor: Google Product: Android Platform: Android

Description

In appendEscapedSQLString of DatabaseUtils.java, there is a possible SQL injection due to unsafe deserialization. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.

Affected products

Vendor	Product	Affected	Fixed
Google	Android	13, 12L, 12, 11	—

Advisories 2

WID-SEC-2023-2548 Google Android: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 3, 2023
WID-SEC-2023-2539 Samsung Android: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 3, 2023

References

https://android.googlesource.com/platform/frameworks/base/+/3287ac2d2565dc96bf6177967f8e3aed33954253
https://source.android.com/security/bulletin/2023-10-01