DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Samsung Android: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2023-10-03
Ein Angreifer kann mehrere Schwachstellen in Samsung Android ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen und seine Rechte zu erweitern.
01
beschreibt (40)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-40140US | high7.8 | — | ||
In android_view_InputDevice_create of android_view_InputDevice.cpp, there is a possible way to execute arbitrary code due to a use after free. This could lead to local escalation o… | ||||
| CVE-2023-40139US | medium5.5 | — | ||
In FillUi of FillUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional executi… | ||||
| CVE-2023-40138US | low3.3 | — | ||
In FillUi of FillUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional executi… | ||||
| CVE-2023-40137US | low3.3 | — | ||
In multiple functions of DialogFillUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no… | ||||
| CVE-2023-40136US | low3.3 | — | ||
In setHeader of DialogFillUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additiona… | ||||
| CVE-2023-40135US | low3.3 | — | ||
In applyCustomDescription of SaveUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no ad… | ||||
| CVE-2023-40134US | low3.3 | — | ||
In isFullScreen of FillUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional e… | ||||
| CVE-2023-40133US | medium5.5 | Exploit | ||
In multiple locations of DialogFillUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no… | ||||
| CVE-2023-40131US | high7.0 | — | ||
In GpuService of GpuService.cpp, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privilege… | ||||
| CVE-2023-40130US | high7.8 | Exploit | ||
In notifyTimeout of CallRedirectionProcessor, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege and backgroun… | ||||
| CVE-2023-40129US | high8.8 | — | ||
In build_read_multi_rsp of gatt_sr.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote (proximal/adjacent) code execution with no a… | ||||
| CVE-2023-40128US | high7.8 | — | ||
In several functions of xmlregexp.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional exec… | ||||
| CVE-2023-40127US | low3.3 | Exploit | ||
In multiple locations, there is a possible way to access screenshots due to a confused deputy. This could lead to local information disclosure with no additional execution privileg… | ||||
| CVE-2023-40125US | high7.8 | — | ||
In onCreate of ApnEditor.java, there is a possible way for a Guest user to change the APN due to a permission bypass. This could lead to local escalation of privilege with no addit… | ||||
| CVE-2023-40123US | medium5.5 | — | ||
In updateActionViews of PipMenuView.java, there is a possible bypass of a multi user security boundary due to a confused deputy. This could lead to local information disclosure wit… | ||||
| CVE-2023-40121US | medium5.5 | — | ||
In appendEscapedSQLString of DatabaseUtils.java, there is a possible SQL injection due to unsafe deserialization. This could lead to local information disclosure with User executio… | ||||
| CVE-2023-40120US | high7.8 | — | ||
In multiple locations, there is a possible way to bypass user notification of foreground services due to improper input validation. This could lead to local escalation of privilege… | ||||
| CVE-2023-40117US | high7.8OT erhöht | — | ||
In resetSettingsLocked of SettingsProvider.java, there is a possible lockscreen bypass due to a permissions bypass. This could lead to local escalation of privilege with no additio… | ||||
| CVE-2023-40116US | high7.8 | — | ||
In onTaskAppeared of PipTaskOrganizer.java, there is a possible way to bypass background activity launch restrictions due to a logic error in the code. This could lead to local esc… | ||||
| CVE-2023-21291US | medium5.5OT erhöht | — | ||
In visitUris of Notification.java, there is a possible way to reveal image contents from another user due to a missing permission check. This could lead to local information disclo… | ||||
20 von 40 angezeigt
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan