DeutschShown in its original language — a full translation is planned for a future version.
Google Android Patchday Mai 2024: Mehrere Schwachstellen
view advisory published 2024-05-06
Ein entfernter, anonymer oder lokaler Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um seine Privilegien zu erhöhen oder vertrauliche Informationen offenlegen.
01
describes (26)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-23709US | medium6.5 | Exploit | ||
In multiple locations, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileg… | ||||
| CVE-2024-23708US | high7.8 | Exploit | ||
In multiple functions of NotificationManagerService.java, there is a possible way to not show a toast message when a clipboard message has been accessed. This could lead to local e… | ||||
| CVE-2024-23707US | high7.8 | — | ||
In multiple locations, there is a possible permissions bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privil… | ||||
| CVE-2024-23706US | high7.8 | — | ||
In multiple locations, there is a possible bypass of health data permissions due to an improper input validation. This could lead to local escalation of privilege with no additiona… | ||||
| CVE-2024-23705US | high7.8 | — | ||
In multiple locations, there is a possible failure to persist or enforce user restrictions due to improper input validation. This could lead to local escalation of privilege with n… | ||||
| CVE-2024-0043US | high7.8OT elevated | — | ||
In multiple locations, there is a possible notification listener grant to an app running in the work profile due to a logic error in the code. This could lead to local escalation o… | ||||
| CVE-2024-0025US | high7.8 | — | ||
In sendIntentSender of ActivityManagerService.java, there is a possible background activity launch due to a logic error. This could lead to local escalation of privilege with no ad… | ||||
| CVE-2024-0024US | high7.8 | — | ||
In multiple methods of UserManagerService.java, there is a possible failure to persist or enforce user restrictions due to improper input validation. This could lead to local escal… | ||||
| CVE-2024-23354US | high7.8 | — | ||
Memory corruption when the IOCTL call is interrupted by a signal. | ||||
| CVE-2024-23351US | high7.8 | — | ||
Memory corruption as GPU registers beyond the last protected range can be accessed through LPAC submissions. | ||||
| CVE-2024-21480US | critical9.8 | — | ||
Memory corruption while playing audio file having large-sized input buffer. | ||||
| CVE-2024-21477US | — | — | ||
Transient DOS while parsing a protected 802.11az Fine Time Measurement (FTM) frame. | ||||
| CVE-2024-21475US | — | — | ||
Memory corruption when the payload received from firmware is not as per the expected protocol size. | ||||
| CVE-2024-21471US | high7.8 | — | ||
Memory corruption when IOMMU unmap of a GPU buffer fails in Linux. | ||||
| CVE-2023-43531US | high7.8 | — | ||
Memory corruption while verifying the serialized header when the key pairs are generated. | ||||
| CVE-2023-43530US | high7.8 | — | ||
Memory corruption in HLOS while checking for the storage type. | ||||
| CVE-2023-43529US | — | — | ||
Transient DOS while processing IKEv2 Informational request messages, when a malformed fragment packet is received. | ||||
| CVE-2023-33119US | high7.0 | — | ||
Memory corruption while loading a VM from a signed VM image that is not coherent in the processor cache. | ||||
| CVE-2024-20057US | — | — | ||
In keyInstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User… | ||||
| CVE-2024-20056US | — | — | ||
In preloader, there is a possible escalation of privilege due to an insecure default value. This could lead to local escalation of privilege with System execution privileges needed… | ||||
showing 20 of 26
02
references
External citations — patches, advisories, analysis.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan