DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Google Android: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2023-10-30
Ein entfernter anonymer Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen und seine Privilegien zu erhöhen.
01
beschreibt (111)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-21386US | — | — | ||
Google Android是美国谷歌（Google）公司的一套以Linux为基础的开源操作系统。
Google Android存在安全漏洞，该漏洞源于输入验证不当，允许本地应用程序访问敏感信息。 | ||||
| CVE-2023-45780US | high7.3 | — | ||
In Print Service, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no additional execution pri… | ||||
| CVE-2023-40101US | medium5.5 | — | ||
In collapse of canonicalize_md.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution… | ||||
| CVE-2023-21398US | high7.8 | — | ||
In sdksandbox, there is a possible strandhogg style overlay attack due to a logic error in the code. This could lead to local escalation of privilege with no additional execution p… | ||||
| CVE-2023-21397US | high7.8 | — | ||
In Setup Wizard, there is a possible way to save a WiFi network due to an insecure default value. This could lead to local escalation of privilege with no additional execution priv… | ||||
| CVE-2023-21396US | high7.8 | — | ||
In Activity Manager, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with User execution privilege… | ||||
| CVE-2023-21395US | medium6.5 | — | ||
In Bluetooth, there is a possible out of bounds read due to a use after free. This could lead to remote information disclosure over Bluetooth with no additional execution privilege… | ||||
| CVE-2023-21394US | medium5.5 | — | ||
In registerPhoneAccount of TelecomServiceImpl.java, there is a possible way to reveal images from another user due to a missing permission check. This could lead to local informati… | ||||
| CVE-2023-21393US | high7.8OT erhöht | — | ||
In Settings, there is a possible way for the user to change SIM due to a missing permission check. This could lead to local escalation of privilege with no additional execution pri… | ||||
| CVE-2023-21392US | high8.8 | — | ||
In Bluetooth, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege when connecting to a Bluetooth device with no addi… | ||||
| CVE-2023-21391US | high7.5 | — | ||
In Messaging, there is a possible way to disable the messaging application due to improper input validation. This could lead to remote denial of service with no additional executio… | ||||
| CVE-2023-21390US | high7.8OT erhöht | — | ||
In Sim, there is a possible way to evade mobile preference restrictions due to a permission bypass. This could lead to local escalation of privilege with no additional execution pr… | ||||
| CVE-2023-21389US | high7.8OT erhöht | — | ||
In Settings, there is a possible bypass of profile owner restrictions due to a missing permission check. This could lead to local escalation of privilege with no additional executi… | ||||
| CVE-2023-21388US | high7.8OT erhöht | — | ||
In Settings, there is a possible restriction bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges need… | ||||
| CVE-2023-21387US | medium4.4 | — | ||
In User Backup Manager, there is a possible way to leak a token to bypass user confirmation for backup due to log information disclosure. This could lead to local information discl… | ||||
| CVE-2023-21385US | medium5.5 | — | ||
In Whitechapel, there is a possible out of bounds read due to memory corruption. This could lead to local information disclosure with no additional execution privileges needed. Use… | ||||
| CVE-2023-21384US | medium5.5 | — | ||
In Package Manager, there is a possible possible permissions bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges n… | ||||
| CVE-2023-21383US | medium5.5 | — | ||
In Settings, there is a possible way for the user to unintentionally send extra data due to an unclear prompt. This could lead to local information disclosure with no additional ex… | ||||
| CVE-2023-21382US | medium5.5OT erhöht | — | ||
In Content Resolver, there is a possible method to access metadata about existing content providers on the device due to a missing permission check. This could lead to local inform… | ||||
| CVE-2023-21381US | high7.8 | — | ||
In Media Resource Manager, there is a possible local arbitrary code execution due to use after free. This could lead to local escalation of privilege with no additional execution p… | ||||
20 von 111 angezeigt
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan