DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Android Patchday Mai 2025: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2025-05-05
Ein Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um erhöhte Privilegien zu erlangen, beliebigen Code auszuführen, einen Denial-of-Service-Zustand zu erzeugen, vertrauliche Informationen preiszugeben oder andere nicht spezifizierte Angriffe auszuführen.
01
beschreibt (46)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-26444US | — | — | ||
In onHandleForceStop of VoiceInteractionManagerService.java, there is a bug that could cause the system to incorrectly revert to the default assistant application when a user-selec… | ||||
| CVE-2025-26442US | medium5.5OT erhöht | — | ||
In onCreate of NotificationAccessConfirmationActivity.java, there is a possible incorrect verification of proper intent filters in NLS due to a logic error in the code. This could… | ||||
| CVE-2025-26440US | —OT erhöht | — | ||
In multiple functions of CameraService.cpp, there is a possible way to use the camera from the background due to a permissions bypass. This could lead to local escalation of privil… | ||||
| CVE-2025-26438US | — | — | ||
In smp_process_secure_connection_oob_data of smp_act.cc, there is a possible way to bypass SMP authentication due to Incorrect implementation of a protocol. This could lead to remo… | ||||
| CVE-2025-26436US | high7.8OT erhöht | — | ||
In clearAllowBgActivityStarts of PendingIntentRecord.java, there is a possible way for an application to launch an activity from the background due to BAL Bypass. This could lead t… | ||||
| CVE-2025-26435US | high7.8 | — | ||
In updateState of ContentProtectionTogglePreferenceController.java, there is a possible way for a secondary user to disable the primary user's deceptive app scanning setting due to… | ||||
| CVE-2025-26430US | high7.8 | — | ||
In getDestinationForApp of SpaAppBridgeActivity, there is a possible cross-user file reveal due to a logic error in the code. This could lead to local escalation of privilege with… | ||||
| CVE-2025-26429US | — | — | ||
In collectOps of AppOpsService.java, there is a possible way to cause permanent DoS due to improper input validation. This could lead to local denial of service with no additional… | ||||
| CVE-2025-26428US | — | — | ||
In startLockTaskMode of LockTaskController.java, there is a possible lock screen bypass due to a logic error in the code. This could lead to physical escalation of privilege with n… | ||||
| CVE-2025-26427US | — | — | ||
In multiple locations, there is a possible Android/data access due to a path traversal error. This could lead to local escalation of privilege with no additional execution privileg… | ||||
| CVE-2025-26426US | — | — | ||
In BroadcastController.java of registerReceiverWithFeatureTraced, there is a possible way to receive broadcasts meant for the "android" package due to improper input validation. Th… | ||||
| CVE-2025-26425US | — | — | ||
In multiple functions of RoleService.java, there is a possible permission squatting vulnerability due to a logic error in the code. This could lead to local escalation of privilege… | ||||
| CVE-2025-26424US | — | — | ||
In multiple functions of VpnManager.java, there is a possible cross-user data leak due to a logic error in the code. This could lead to local information disclosure with no additio… | ||||
| CVE-2025-26423US | — | — | ||
In validateIpConfiguration of WifiConfigurationUtil.java, there is a possible way to trigger a permanent DoS due to a missing bounds check. This could lead to local escalation of p… | ||||
| CVE-2025-26422US | — | — | ||
In dump of WindowManagerService.java, there is a possible way of running dumpsys without the required permission due to a missing permission check. This could lead to local escalat… | ||||
| CVE-2025-26421US | — | — | ||
In multiple locations, there is a possible lock screen bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privil… | ||||
| CVE-2025-26420US | — | — | ||
In multiple functions of GrantPermissionsActivity.java , there is a possible way to trick the user into granting the incorrect permission due to permission overload. This could lea… | ||||
| CVE-2025-22425US | —OT erhöht | — | ||
In onCreate of InstallStart.java, there is a possible permissions bypass due to improper input validation. This could lead to local escalation of privilege with no additional execu… | ||||
| CVE-2025-0087US | — | Exploit | ||
In onCreate of UninstallerActivity.java, there is a possible way to uninstall a different user's app due to a missing permission check. This could lead to local escalation of privi… | ||||
| CVE-2025-0077US | — | — | ||
In multiple functions of UserController.java, there is a possible lock screen bypass due to a race condition. This could lead to local escalation of privilege with no additional ex… | ||||
20 von 46 angezeigt
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan