NLShown in its original language — a full translation is planned for a future version.
Kwetsbaarheden verholpen in Google Android en Samsung Mobile
view advisory published 2024-11-05
Google heeft kwetsbaarheden verholpen in Android. In deze update zijn ook updates meegenomen voor closed-source componenten van Qualcomm, Imagination Technologies en MediaTek. Samsung heeft kwetsbaarheden in Samsung Mobile verholpen die relevant zijn voor Samsung mobile devices.
01
describes (53)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-43093US | high7.3OT critical | KEV | ||
In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicod… | ||||
| CVE-2024-43091US | critical9.8 | — | ||
In filterMask of SkEmbossMaskFilter.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution p… | ||||
| CVE-2024-43090US | medium5.0OT elevated | — | ||
In multiple locations, there is a possible cross-user image read due to a missing permission check. This could lead to local information disclosure with User execution privileges n… | ||||
| CVE-2024-43089US | high7.8OT elevated | — | ||
In updateInternal of MediaProvider.java , there is a possible access of another app's files due to a missing permission check. This could lead to local escalation of privilege with… | ||||
| CVE-2024-43088US | high7.8OT elevated | — | ||
In multiple functions in AppInfoBase.java, there is a possible way to manipulate app permission settings belonging to another user on the device due to a missing permission check.… | ||||
| CVE-2024-43087US | high7.8OT elevated | — | ||
In getInstalledAccessibilityPreferences of AccessibilitySettings.java, there is a possible way to hide an enabled accessibility service in the accessibility service settings due to… | ||||
| CVE-2024-43086US | medium5.5OT elevated | — | ||
In validateAccountsInternal of AccountManagerService.java, there is a possible way to leak account credentials to a third party app due to a confused deputy. This could lead to loc… | ||||
| CVE-2024-43085US | high7.8OT elevated | — | ||
In handleMessage of UsbDeviceManager.java, there is a possible method to access device contents over USB without unlocking the device due to a logic error in the code. This could l… | ||||
| CVE-2024-43084US | medium5.5 | — | ||
In visitUris of multiple files, there is a possible information disclosure due to a confused deputy. This could lead to local information disclosure with no additional execution pr… | ||||
| CVE-2024-43083US | medium5.5 | — | ||
In validate of WifiConfigurationUtil.java , there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service with no addition… | ||||
| CVE-2024-43082US | medium5.5 | — | ||
In onActivityResult of EditUserPhotoController.java, there is a possible cross-user media read due to a confused deputy. This could lead to local information disclosure with no add… | ||||
| CVE-2024-43081US | high7.8OT elevated | — | ||
In installExistingPackageAsUser of InstallPackageHelper.java, there is a possible carrier restriction bypass due to a logic error in the code. This could lead to local escalation o… | ||||
| CVE-2024-43080US | high7.8 | — | ||
In onReceive of AppRestrictionsFragment.java, there is a possible escalation of privilege due to unsafe deserialization. This could lead to local escalation of privilege with no ad… | ||||
| CVE-2024-40671US | high7.8OT elevated | — | ||
In DevmemIntChangeSparse2 of devicemem_server.c, there is a possible way to achieve arbitrary code execution due to a missing permission check. This could lead to local escalation… | ||||
| CVE-2024-40661US | high7.8OT elevated | — | ||
In mayAdminGrantPermission of AdminRestrictedPermissionsUtils.java, there is a possible way to access the microphone due to a missing permission check. This could lead to local esc… | ||||
| CVE-2024-40660US | high7.8OT elevated | — | ||
In setTransactionState of SurfaceFlinger.cpp, there is a possible way to change protected display attributes due to a logic error in the code. This could lead to local escalation o… | ||||
| CVE-2024-34747US | high7.8 | — | ||
In DevmemXIntMapPages of devicemem_server.c, there is a possible use-after-free due to a logic error in the code. This could lead to local escalation of privilege in the kernel wit… | ||||
| CVE-2024-34729US | high7.8 | — | ||
In multiple locations, there is a possible arbitrary code execution due to a logic error in the code. This could lead to local escalation of privilege in the kernel with no additio… | ||||
| CVE-2024-34719US | high7.8OT elevated | — | ||
In multiple locations, there is a possible permissions bypass due to a missing null check. This could lead to local escalation of privilege with no additional execution privileges… | ||||
| CVE-2024-31337US | high7.8 | — | ||
In PVRSRVRGXKickTA3DKM of rgxta3d.c, there is a possible arbitrary code execution due to improper input validation. This could lead to local escalation of privilege in the kernel w… | ||||
showing 20 of 53
02
references
External citations — patches, advisories, analysis.
- Reference - ncscclearexternal
- Reference - hkcertexternal
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan