DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Google Android: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2021-02-01
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen, Informationen offenzulegen, einen Denial of Service Absturz herbeizuführen, seine Privilegien zu erhöhen oder unbekannte Auswirkungen zu verursachen.
01
beschreibt (44)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2020-11297US | high7.5 | — | ||
Denial of service in WLAN module due to improper check of subtypes in logic where excessive frames are dropped in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snap… | ||||
| CVE-2020-11296US | high7.5 | — | ||
Arithmetic overflow can happen while processing NOA IE due to improper error handling in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electroni… | ||||
| CVE-2020-11287US | high7.5 | — | ||
Allowing RTT frames to be linked with non randomized MAC address by comparing the sequence numbers can lead to information disclosure. in Snapdragon Auto, Snapdragon Compute, Snapd… | ||||
| CVE-2020-11286US | medium6.8 | — | ||
An Untrusted Pointer Dereference can occur while doing USB control transfers, if multiple requests of different standard request categories like device, interface & endpoint are ma… | ||||
| CVE-2020-11283US | critical9.8 | — | ||
A buffer overflow can occur when playing an MKV clip due to lack of input validation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapd… | ||||
| CVE-2020-11282US | high7.8 | — | ||
Improper access control when using mmap with the kgsl driver with a special offset value that can be provided to map the memstore of the GPU to user space in Snapdragon Auto, Snapd… | ||||
| CVE-2020-11281US | high7.5 | — | ||
Allowing RTT frames to be linked with non randomized MAC address by comparing the sequence numbers can lead to information disclosure. in Snapdragon Auto, Snapdragon Compute, Snapd… | ||||
| CVE-2020-11280US | high7.5 | — | ||
Denial of service while processing fine timing measurement request (FTMR) frame with reserved bits set in the FTM parameter IE due to improper error handling in Snapdragon Auto, Sn… | ||||
| CVE-2020-11278US | high7.5 | — | ||
Possible denial of service while handling host WMI command due to improper validation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electroni… | ||||
| CVE-2020-11277US | high7.4 | — | ||
Possible race condition during async fastrpc session after sending RPC message due to the fastrpc ctx gets free during async session in Snapdragon Compute, Snapdragon Industrial IO… | ||||
| CVE-2020-11276US | critical9.1 | — | ||
Possible buffer over read while processing P2P IE and NOA attribute of beacon and probe response frames due to improper validation of P2P IE and NOA attribute lengths in Snapdragon… | ||||
| CVE-2020-11275US | critical9.1 | — | ||
Possible buffer over-read while parsing quiet IE in Rx beacon frame due to improper check of IE length in received beacon in Snapdragon Auto, Snapdragon Compute, Snapdragon Connect… | ||||
| CVE-2020-11272US | critical9.8 | — | ||
Before enqueuing a frame to the PE queue for further processing, an entry in a hash table can be deleted and using a stale version later can lead to use after free condition in Sna… | ||||
| CVE-2020-11271US | high7.8 | — | ||
Possible out of bounds while accessing global control elements due to race condition in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapd… | ||||
| CVE-2020-11270US | high7.5 | — | ||
Possible denial of service due to RTT responder consistently rejects all FTMR by transmitting FTM1 with failure status in the FTM parameter IE in Snapdragon Auto, Snapdragon Comput… | ||||
| CVE-2020-11269US | high8.8 | — | ||
Possible memory corruption while processing EAPOL frames due to lack of validation of key length before using it in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Sn… | ||||
| CVE-2020-11253US | high7.8 | — | ||
Arbitrary memory write issue in video driver while setting the internal buffers in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon… | ||||
| CVE-2020-11203US | high7.1 | — | ||
Stack overflow may occur if GSM/WCDMA broadcast config size received from user is larger than variable length array in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer… | ||||
| CVE-2020-11187US | high7.8 | — | ||
Possible memory corruption in BSI module due to improper validation of parameter count in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Mobile | ||||
| CVE-2020-11177US | high8.8 | — | ||
User can overwrite Security Code NV item without knowing current SPC due to improper validation of SPC code setting and device lock in Snapdragon Auto, Snapdragon Compute, Snapdrag… | ||||
20 von 44 angezeigt
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- BlackBerry Security Bulletinexternal
- Red Hat Security Advisory RHSA-2023:0756 vom 2023-02-14external
- Red Hat Security Advisory RHSA-2023:2723 vom 2023-05-10external
- Android Patchday Februar vom 2021-02-01external
- Pixel Patchday Februar vom 2021-02-01external
- Exploit auf Sploitus.com vom 2021-02-08external
- WID-SEC-W-2023-0360 - CSAF Versionself
- WID-SEC-2023-0360 - Portal Versionself
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan