{"vulnerability": "CVE-2023-4412", "sightings": [{"uuid": "211b9a1b-b882-4e96-91ce-727836e140aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2023-44127", "type": "seen", "source": "https://t.me/cibsecurity/71079", "content": "\u203c CVE-2023-44127 \u203c\n\nhe vulnerability is that the Call management (\"com.android.server.telecom\") app patched by LG launches implicit intents that disclose sensitive data to all third-party apps installed on the same device. Those intents include data such as contact details and phone numbers.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-09-27T18:42:04.000000Z"}, {"uuid": "0f291ff6-c83f-4dab-a294-6f783a91176a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2023-44121", "type": "seen", "source": "https://gist.github.com/Darkcrai86/f0bc59e87b0f256e3fe6bd76f97ae9a6", "content": "", "creation_timestamp": "2025-09-18T07:49:15.000000Z"}, {"uuid": "19742fb9-6077-4053-a698-6128863766c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2023-44128", "type": "seen", "source": "https://t.me/cibsecurity/71086", "content": "\u203c CVE-2023-44128 \u203c\n\nhe vulnerability is to delete arbitrary files in LGInstallService (\"com.lge.lginstallservies\") app. The app contains the exported \"com.lge.lginstallservies.InstallService\" service that exposes an AIDL interface. All its \"installPackage*\" methods are finally calling the \"installPackageVerify()\" method that performs signature validation after the delete file method. An attacker can control conditions so this security check is never performed and an attacker-controlled file is deleted.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-09-27T18:42:11.000000Z"}, {"uuid": "639a71a2-6876-4336-a0bb-2ca4346465e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2023-44124", "type": "seen", "source": "https://t.me/cibsecurity/71084", "content": "\u203c CVE-2023-44124 \u203c\n\nThe vulnerability is to theft of arbitrary files with system privilege in the Screen recording (\"com.lge.gametools.gamerecorder\") app in the \"com/lge/gametools/gamerecorder/settings/ProfilePreferenceFragment.java\" file. The main problem is that the app launches implicit intents that can be intercepted by third-party apps installed on the same device. They also can return arbitrary data that will be passed to the \"onActivityResult()\" method. The Screen recording app saves contents of arbitrary URIs to SD card which is a world-readable storage.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-09-27T18:42:09.000000Z"}, {"uuid": "8c84833d-01d3-4371-a232-ecd6996b79e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2023-44122", "type": "seen", "source": "https://t.me/cibsecurity/71075", "content": "\u203c CVE-2023-44122 \u203c\n\nThe vulnerability is to theft of arbitrary files with system privilege in the LockScreenSettings (\"com.lge.lockscreensettings\") app in the \"com/lge/lockscreensettings/dynamicwallpaper/MyCategoryGuideActivity.java\" file. The main problem is that the app launches implicit intents that can be intercepted by third-party apps installed on the same device. They also can return arbitrary data that will be passed to the \"onActivityResult()\" method. The LockScreenSettings app copies the received file to the \"/data/shared/dw/mycategory/wallpaper_01.png\" path and then changes the file access mode to world-readable and world-writable.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-09-27T18:42:00.000000Z"}, {"uuid": "07c9a720-33a8-49be-ae59-54c21e792172", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2023-44120", "type": "seen", "source": "https://t.me/ctinow/164932", "content": "https://ift.tt/o16Xmd5\nCVE-2023-44120", "creation_timestamp": "2024-01-09T11:26:11.000000Z"}]}