DeutschShown in its original language — a full translation is planned for a future version.
Samsung Android: Mehrere Schwachstellen
view advisory published 2024-03-04
Ein entfernter anonymer Angreifer kann mehrere Schwachstellen in Samsung Android ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen oder seine Rechte zu erweitern.
01
describes (41)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-23717US | high8.8 | — | ||
In access_secure_service_from_temp_bond of btm_sec.cc, there is a possible way to achieve keystroke injection due to improper input validation. This could lead to remote (proximal/… | ||||
| CVE-2024-0053US | low3.3 | — | ||
In getCustomPrinterIcon of PrintManagerService.java, there is a possible way to view other user's images due to a confused deputy. This could lead to local information disclosure w… | ||||
| CVE-2024-0052US | low3.3OT elevated | — | ||
In multiple functions of healthconnect, there is a possible leakage of exercise route data due to a missing permission check. This could lead to local information disclosure with n… | ||||
| CVE-2024-0051US | high7.8 | — | ||
In onQueueFilled of SoftMPEG4.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execut… | ||||
| CVE-2024-0050US | high7.8 | — | ||
In getConfig of SoftVideoDecoderOMXComponent.cpp, there is a possible out of bounds write due to a missing validation check. This could lead to a local non-security issue with no a… | ||||
| CVE-2024-0049US | high7.8 | — | ||
In multiple locations, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileg… | ||||
| CVE-2024-0048US | high7.8 | — | ||
In Session of AccountManagerService.java, there is a possible method to retain foreground service privileges due to incorrect handling of null responses. This could lead to local e… | ||||
| CVE-2024-0047US | medium5.5 | — | ||
In writeUserLP of UserManagerService.java, device policies are serialized with an incorrect tag due to a logic error in the code. This could lead to local denial of service when po… | ||||
| CVE-2024-0046US | high7.8 | — | ||
In installExistingPackageAsUser of InstallPackageHelper.java, there is a possible carrier restriction bypass due to a logic error in the code. This could lead to local escalation o… | ||||
| CVE-2024-0045US | medium6.5 | — | ||
In smp_proc_sec_req of smp_act.cc, there is a possible out of bounds read due to improper input validation. This could lead to remote (proximal/adjacent) information disclosure wit… | ||||
| CVE-2024-0044US | medium6.7 | Exploit | ||
In createSessionInternal of PackageInstallerService.java, there is a possible run-as any app due to improper input validation. This could lead to local escalation of privilege with… | ||||
| CVE-2024-0039US | critical9.8 | Exploit | ||
In attp_build_value_cmd of att_protocol.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execu… | ||||
| CVE-2023-43536US | — | — | ||
Transient DOS while parse fils IE with length equal to 1. | ||||
| CVE-2023-43534US | critical9.8 | — | ||
Memory corruption while validating the TID to Link Mapping action request frame, when a station connects to an access point. | ||||
| CVE-2023-43533US | — | — | ||
Transient DOS in WLAN Firmware when the length of received beacon is less than length of ieee802.11 beacon frame. | ||||
| CVE-2023-43523US | — | — | ||
Transient DOS while processing 11AZ RTT management action frame received through OTA. | ||||
| CVE-2023-43522US | — | — | ||
Transient DOS while key unwrapping process, when the given encrypted key is empty or NULL. | ||||
| CVE-2023-43520US | critical9.8 | — | ||
Memory corruption when AP includes TID to link mapping IE in the beacons and STA is parsing the beacon TID to link mapping IE. | ||||
| CVE-2023-43516US | — | — | ||
Memory corruption when malformed message payload is received from firmware. | ||||
| CVE-2023-43513US | — | — | ||
Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to address in the middle of… | ||||
showing 20 of 41
02
references
External citations — patches, advisories, analysis.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan