DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Android Patchday Oktober 2024: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2024-10-07
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen oder einen Denial-of-Service-Zustand zu erzeugen.
01
beschreibt (26)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-40677US | —OT erhöht | — | ||
In shouldSkipForInitialSUW of AdvancedPowerUsageDetail.java, there is a possible way to bypass factory reset protections due to a missing permission check. This could lead to local… | ||||
| CVE-2024-40676US | — | Exploit | ||
In checkKeyIntent of AccountManagerService.java, there is a possible way to bypass intent security check and install an unknown app due to a confused deputy. This could lead to loc… | ||||
| CVE-2024-40675US | — | — | ||
In parseUriInternal of Intent.java, there is a possible infinite loop due to improper input validation. This could lead to local denial of service with no additional execution priv… | ||||
| CVE-2024-40674US | — | — | ||
In validateSsid of WifiConfigurationUtil.java, there is a possible way to overflow a system configuration file due to a logic error in the code. This could lead to local denial of… | ||||
| CVE-2024-40673US | — | — | ||
In Source of ZipFile.java, there is a possible way for an attacker to execute arbitrary code by manipulating Dynamic Code Loading due to improper input validation. This could lead… | ||||
| CVE-2024-40672US | — | — | ||
In onCreate of ChooserActivity.java, there is a possible way to bypass factory reset protections due to a missing permission check. This could lead to local escalation of privilege… | ||||
| CVE-2024-40670US | — | — | ||
In TBD of TBD, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User int… | ||||
| CVE-2024-40669US | — | — | ||
In TBD of TBD, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User int… | ||||
| CVE-2024-40651US | — | — | ||
In TBD of TBD, there is a possible use-after-free due to a logic error in the code. This could lead to local escalation of privilege in the kernel with no additional execution priv… | ||||
| CVE-2024-40649US | — | — | ||
In TBD of TBD, there is a possible use-after-free due to a logic error in the code. This could lead to local escalation of privilege in the kernel with no additional execution priv… | ||||
| CVE-2024-34748US | — | — | ||
In _DevmemXReservationPageAddress of devicemem_server.c, there is a possible use-after-free due to improper casting. This could lead to local escalation of privilege in the kernel… | ||||
| CVE-2024-34733US | — | — | ||
In DevmemXIntMapPages of devicemem_server.c, there is a possible arbitrary code execution due to an integer overflow. This could lead to local escalation of privilege in the kernel… | ||||
| CVE-2024-34732US | — | — | ||
In RGXMMUCacheInvalidate of rgxmem.c, there is a possible arbitrary code execution due to a race condition. This could lead to local escalation of privilege in the kernel with no a… | ||||
| CVE-2024-38399US | high7.8 | Exploit | ||
Memory corruption while processing user packets to generate page faults. | ||||
| CVE-2024-33069US | — | — | ||
Transient DOS when transmission of management frame sent by host is not successful and error status is received in the host. | ||||
| CVE-2024-33049US | high7.5 | — | ||
Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame. | ||||
| CVE-2024-23369US | — | — | ||
Memory corruption when invalid length is provided from HLOS for FRS/UDS request/response buffers. | ||||
| CVE-2024-20103US | — | — | ||
In wlan firmware, there is a possible out of bounds write due to improper input validation. This could lead to remote code execution with no additional execution privileges needed.… | ||||
| CVE-2024-20101US | — | — | ||
In wlan driver, there is a possible out of bounds write due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. U… | ||||
| CVE-2024-20100US | — | — | ||
In wlan driver, there is a possible out of bounds write due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. U… | ||||
20 von 26 angezeigt
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan