DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Google Android Patchday Mai 2024: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2024-05-06
Ein entfernter, anonymer oder lokaler Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um seine Privilegien zu erhöhen oder vertrauliche Informationen offenlegen.
01
beschreibt (26)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-23709US | medium6.5 | Exploit | ||
In multiple locations, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileg… | ||||
| CVE-2024-23708US | high7.8 | Exploit | ||
In multiple functions of NotificationManagerService.java, there is a possible way to not show a toast message when a clipboard message has been accessed. This could lead to local e… | ||||
| CVE-2024-23707US | high7.8 | — | ||
In multiple locations, there is a possible permissions bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privil… | ||||
| CVE-2024-23706US | high7.8 | — | ||
In multiple locations, there is a possible bypass of health data permissions due to an improper input validation. This could lead to local escalation of privilege with no additiona… | ||||
| CVE-2024-23705US | high7.8 | — | ||
In multiple locations, there is a possible failure to persist or enforce user restrictions due to improper input validation. This could lead to local escalation of privilege with n… | ||||
| CVE-2024-0043US | high7.8OT erhöht | — | ||
In multiple locations, there is a possible notification listener grant to an app running in the work profile due to a logic error in the code. This could lead to local escalation o… | ||||
| CVE-2024-0025US | high7.8 | — | ||
In sendIntentSender of ActivityManagerService.java, there is a possible background activity launch due to a logic error. This could lead to local escalation of privilege with no ad… | ||||
| CVE-2024-0024US | high7.8 | — | ||
In multiple methods of UserManagerService.java, there is a possible failure to persist or enforce user restrictions due to improper input validation. This could lead to local escal… | ||||
| CVE-2024-23354US | high7.8 | — | ||
Memory corruption when the IOCTL call is interrupted by a signal. | ||||
| CVE-2024-23351US | high7.8 | — | ||
Memory corruption as GPU registers beyond the last protected range can be accessed through LPAC submissions. | ||||
| CVE-2024-21480US | critical9.8 | — | ||
Memory corruption while playing audio file having large-sized input buffer. | ||||
| CVE-2024-21477US | — | — | ||
Transient DOS while parsing a protected 802.11az Fine Time Measurement (FTM) frame. | ||||
| CVE-2024-21475US | — | — | ||
Memory corruption when the payload received from firmware is not as per the expected protocol size. | ||||
| CVE-2024-21471US | high7.8 | — | ||
Memory corruption when IOMMU unmap of a GPU buffer fails in Linux. | ||||
| CVE-2023-43531US | high7.8 | — | ||
Memory corruption while verifying the serialized header when the key pairs are generated. | ||||
| CVE-2023-43530US | high7.8 | — | ||
Memory corruption in HLOS while checking for the storage type. | ||||
| CVE-2023-43529US | — | — | ||
Transient DOS while processing IKEv2 Informational request messages, when a malformed fragment packet is received. | ||||
| CVE-2023-33119US | high7.0 | — | ||
Memory corruption while loading a VM from a signed VM image that is not coherent in the processor cache. | ||||
| CVE-2024-20057US | — | — | ||
In keyInstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User… | ||||
| CVE-2024-20056US | — | — | ||
In preloader, there is a possible escalation of privilege due to an insecure default value. This could lead to local escalation of privilege with System execution privileges needed… | ||||
20 von 26 angezeigt
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan