DeutschShown in its original language — a full translation is planned for a future version.
Android Patchday Dezember 2024: Mehrere Schwachstellen
view advisory published 2024-12-02
Ein entfernter anonymer Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um seine Privilegien zu erhöhen oder beliebigen Code auszuführen.
01
describes (14)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-43769US | —OT elevated | — | ||
In isPackageDeviceAdmin of PackageManagerService.java, there is a possible edge case which could prevent the uninstallation of CloudDpc due to a logic error in the code. This could… | ||||
| CVE-2024-43768US | — | — | ||
In skia_alloc_func of SkDeflate.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional executi… | ||||
| CVE-2024-43767US | — | — | ||
In prepare_to_draw_into_mask of SkBlurMaskFilterImpl.cpp, there is a possible heap overflow due to improper input validation. This could lead to remote code execution with no addit… | ||||
| CVE-2024-43764US | — | — | ||
In onPrimaryClipChanged of ClipboardListener.java, there is a possible way to partially bypass lock screen. This could lead to local escalation of privilege with no additional exec… | ||||
| CVE-2024-43762US | — | — | ||
In multiple locations, there is a possible way to avoid unbinding of a service from the system due to a logic error in the code. This could lead to local escalation of privilege wi… | ||||
| CVE-2024-43097US | — | — | ||
In resizeToAtLeast of SkRegion.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional executio… | ||||
| CVE-2024-43077US | — | — | ||
In DevmemValidateFlags of devicemem_server.c , there is a possible out of bounds write due to memory corruption. This could lead to local escalation of privilege with no additional… | ||||
| CVE-2024-43052US | — | — | ||
Memory corruption while processing API calls to NPU with invalid input. | ||||
| CVE-2024-43048US | — | — | ||
Memory corruption when invalid input is passed to invoke GPU Headroom API call. | ||||
| CVE-2024-33063US | — | — | ||
Transient DOS while parsing the ML IE when a beacon with common info length of the ML IE greater than the ML IE inside which this element is present. | ||||
| CVE-2024-33056US | high7.8 | — | ||
Memory corruption when allocating and accessing an entry in an SMEM partition continuously. | ||||
| CVE-2024-33044US | high7.8 | — | ||
Memory corruption while Configuring the SMR/S2CR register in Bypass mode. | ||||
| CVE-2024-20125US | — | — | ||
In vdec, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained System pr… | ||||
| CVE-2024-43701US | — | — | ||
Software installed and run as a non-privileged user may conduct GPU system calls to read and write freed physical memory from the GPU. | ||||
02
references
External citations — patches, advisories, analysis.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan