DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Android Patchday Februar 2023
Advisory ansehen veröffentlicht 2023-02-06
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um seine Privilegien zu erhöhen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand zu verursachen.
01
beschreibt (42)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-20942US | medium5.5 | — | ||
In openMmapStream of AudioFlinger.cpp, there is a possible way to record audio without displaying the microphone privacy indicator due to a logic error in the code. This could lead… | ||||
| CVE-2022-20443US | high7.8 | — | ||
In hasInputInfo of Layer.cpp, there is a possible bypass of user interaction requirements due to a tapjacking/overlay attack. This could lead to local escalation of privilege with… | ||||
| CVE-2023-20948US | high7.5 | — | ||
In dropFramesUntilIframe of AAVCAssembler.cpp, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additi… | ||||
| CVE-2023-20946US | critical9.8 | — | ||
In onStart of BluetoothSwitchPreferenceController.java, there is a possible permission bypass due to a confused deputy. This could lead to remote escalation of privilege in Bluetoo… | ||||
| CVE-2023-20945US | high7.8 | — | ||
In phNciNfc_MfCreateXchgDataHdr of phNxpExtns_MifareStd.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege… | ||||
| CVE-2023-20944US | high7.8 | Exploit | ||
In run of ChooseTypeAndAccountActivity.java, there is a possible escalation of privilege due to unsafe deserialization. This could lead to local escalation of privilege with no add… | ||||
| CVE-2023-20943US | high7.8 | Exploit | ||
In clearApplicationUserData of ActivityManagerService.java, there is a possible way to remove system files due to a path traversal error. This could lead to local escalation of pri… | ||||
| CVE-2023-20940US | high7.8 | — | ||
In the Android operating system, there is a possible way to replace a boot partition due to improperly used crypto. This could lead to local escalation of privilege with no additio… | ||||
| CVE-2023-20939US | high7.8 | — | ||
In multiple functions of looper_backed_event_loop.cpp, there is a possible way to corrupt memory due to improper locking. This could lead to local escalation of privilege with no a… | ||||
| CVE-2023-20938US | high7.8 | Exploit | ||
In binder_transaction_buffer_release of binder.c, there is a possible use after free due to improper input validation. This could lead to local escalation of privilege with no addi… | ||||
| CVE-2023-20937US | high7.8 | — | ||
In several functions of the Android Linux kernel, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with no additi… | ||||
| CVE-2023-20934US | high7.8 | — | ||
In resolveAttributionSource of ServiceUtilities.cpp, there is a possible way to disable the microphone privacy indicator due to a permissions bypass. This could lead to local escal… | ||||
| CVE-2023-20933US | high7.8 | Exploit | ||
In several functions of MediaCodec.cpp, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with no additional execu… | ||||
| CVE-2023-20932US | low3.3 | — | ||
In onCreatePreferences of EditInfoFragment.java, there is a possible way to read contacts belonging to other users due to improper input validation. This could lead to local inform… | ||||
| CVE-2022-20551US | medium6.7 | — | ||
In createTrack of AudioFlinger.cpp, there is a possible way to record audio without a privacy indicator due to a logic error in the code. This could lead to local escalation of pri… | ||||
| CVE-2022-20481US | medium5.5 | — | ||
In multiple files, there is a possible way to preserve WiFi settings due to residual data after a reset. This could lead to local information disclosure with no additional executio… | ||||
| CVE-2022-20455US | medium5.5 | — | ||
In addAutomaticZenRule of ZenModeHelper.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service with no additi… | ||||
| CVE-2023-20949US | medium5.5 | — | ||
In s2mpg11_pmic_probe of s2mpg11-regulator.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with no addition… | ||||
| CVE-2022-47339US | medium6.7OT erhöht | — | ||
In cmd services, there is a OS command injection issue due to missing permission check. This could lead to local escalation of privilege with system execution privileges needed. | ||||
| CVE-2022-47331US | medium4.7 | — | ||
In wlan driver, there is a race condition. This could lead to local denial of service in wlan services. | ||||
20 von 42 angezeigt
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Android Security Bulletin - February 2023 vom 2023-02-06external
- Android Security Bulletin - February 2023 vom 2023-02-06external
- Ubuntu Security Notice USN-5934-1 vom 2023-03-07external
- Ubuntu Security Notice USN-5939-1 vom 2023-03-08external
- Ubuntu Security Notice USN-5940-1 vom 2023-03-09external
- Ubuntu Security Notice USN-5951-1 vom 2023-03-14external
- Ubuntu Security Notice USN-6133-1 vom 2023-06-01external
- Ubuntu Security Notice USN-6134-1 vom 2023-06-01external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan