Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CERTFR-2023-AVI-0811
Vulnerability from certfr_avis - Published: 2023-10-06 - Updated: 2023-10-06
De multiples vulnérabilités ont été découvertes dans Google Android. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.
L'éditeur indique que les vulnérabilités CVE-2023-4863 et CVE-2023-4211 sont exploitées.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Google Android versions 11, 12, 12L, 13 sans le correctif de s\u00e9curit\u00e9 du 06 octobre 2023",
"product": {
"name": "Android",
"vendor": {
"name": "Google",
"scada": false
}
}
},
{
"description": "Google Pixel sans le correctif de s\u00e9curit\u00e9 du 05 octobre 2023",
"product": {
"name": "Android",
"vendor": {
"name": "Google",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-40524",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-40524"
},
{
"name": "CVE-2023-40125",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-40125"
},
{
"name": "CVE-2023-40120",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-40120"
},
{
"name": "CVE-2023-40128",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-40128"
},
{
"name": "CVE-2023-40116",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-40116"
},
{
"name": "CVE-2023-22385",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-22385"
},
{
"name": "CVE-2023-21644",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21644"
},
{
"name": "CVE-2023-21636",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21636"
},
{
"name": "CVE-2023-21266",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21266"
},
{
"name": "CVE-2023-3781",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-3781"
},
{
"name": "CVE-2023-35660",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-35660"
},
{
"name": "CVE-2023-35646",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-35646"
},
{
"name": "CVE-2022-28348",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-28348"
},
{
"name": "CVE-2023-40136",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-40136"
},
{
"name": "CVE-2023-40130",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-40130"
},
{
"name": "CVE-2023-33035",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33035"
},
{
"name": "CVE-2023-32820",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-32820"
},
{
"name": "CVE-2023-22384",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-22384"
},
{
"name": "CVE-2023-28539",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28539"
},
{
"name": "CVE-2023-35656",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-35656"
},
{
"name": "CVE-2023-40141",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-40141"
},
{
"name": "CVE-2023-21654",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21654"
},
{
"name": "CVE-2023-35648",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-35648"
},
{
"name": "CVE-2023-33029",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33029"
},
{
"name": "CVE-2023-40138",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-40138"
},
{
"name": "CVE-2023-40638",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-40638"
},
{
"name": "CVE-2023-40135",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-40135"
},
{
"name": "CVE-2023-40139",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-40139"
},
{
"name": "CVE-2023-21673",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21673"
},
{
"name": "CVE-2023-28540",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28540"
},
{
"name": "CVE-2023-35663",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-35663"
},
{
"name": "CVE-2023-33027",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33027"
},
{
"name": "CVE-2023-24848",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24848"
},
{
"name": "CVE-2023-21655",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21655"
},
{
"name": "CVE-2023-35654",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-35654"
},
{
"name": "CVE-2023-35653",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-35653"
},
{
"name": "CVE-2023-40117",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-40117"
},
{
"name": "CVE-2023-33200",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33200"
},
{
"name": "CVE-2023-35649",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-35649"
},
{
"name": "CVE-2023-24847",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24847"
},
{
"name": "CVE-2023-24850",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24850"
},
{
"name": "CVE-2023-32819",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-32819"
},
{
"name": "CVE-2023-21291",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21291"
},
{
"name": "CVE-2023-33026",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33026"
},
{
"name": "CVE-2023-40127",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-40127"
},
{
"name": "CVE-2023-35662",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-35662"
},
{
"name": "CVE-2023-21252",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21252"
},
{
"name": "CVE-2023-35645",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-35645"
},
{
"name": "CVE-2023-40134",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-40134"
},
{
"name": "CVE-2023-21667",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21667"
},
{
"name": "CVE-2023-24843",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24843"
},
{
"name": "CVE-2023-35655",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-35655"
},
{
"name": "CVE-2023-35652",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-35652"
},
{
"name": "CVE-2023-21253",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21253"
},
{
"name": "CVE-2023-40129",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-40129"
},
{
"name": "CVE-2023-35647",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-35647"
},
{
"name": "CVE-2023-20819",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-20819"
},
{
"name": "CVE-2023-4211",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-4211"
},
{
"name": "CVE-2023-33034",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33034"
},
{
"name": "CVE-2023-40123",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-40123"
},
{
"name": "CVE-2023-24853",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24853"
},
{
"name": "CVE-2022-33220",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-33220"
},
{
"name": "CVE-2023-40137",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-40137"
},
{
"name": "CVE-2023-21663",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21663"
},
{
"name": "CVE-2023-40131",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-40131"
},
{
"name": "CVE-2023-24849",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24849"
},
{
"name": "CVE-2023-33028",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33028"
},
{
"name": "CVE-2023-4863",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-4863"
},
{
"name": "CVE-2023-24855",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24855"
},
{
"name": "CVE-2021-44828",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44828"
},
{
"name": "CVE-2023-40140",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-40140"
},
{
"name": "CVE-2023-40121",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-40121"
},
{
"name": "CVE-2023-24844",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24844"
},
{
"name": "CVE-2023-40133",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-40133"
},
{
"name": "CVE-2023-21244",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21244"
},
{
"name": "CVE-2023-28571",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28571"
},
{
"name": "CVE-2023-40142",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-40142"
},
{
"name": "CVE-2023-34970",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-34970"
},
{
"name": "CVE-2023-35661",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-35661"
}
],
"initial_release_date": "2023-10-06T00:00:00",
"last_revision_date": "2023-10-06T00:00:00",
"links": [],
"reference": "CERTFR-2023-AVI-0811",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-10-06T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Google Android.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance\net une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n\nL\u0027\u00e9diteur indique que les vuln\u00e9rabilit\u00e9s CVE-2023-4863 et CVE-2023-4211\nsont exploit\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Google Android",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Android Pixel du 04 octobre 2023",
"url": "https://source.android.com/docs/security/bulletin/pixel/2023-10-01"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Android du 02 octobre 2023",
"url": "https://source.android.com/docs/security/bulletin/2023-10-01?hl=fr#2023-10-01-security-patch-level-vulnerability-details"
}
]
}
CVE-2023-40125 (GCVE-0-2023-40125)
Vulnerability from cvelistv5 – Published: 2023-10-27 20:22 – Updated: 2025-05-05 14:59
VLAI
EPSS
VEX
Summary
In onCreate of ApnEditor.java, there is a possible way for a Guest user to change the APN due to a permission bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- Elevation of privilege
- CWE-noinfo Not enough information
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:24:55.546Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://android.googlesource.com/platform/packages/apps/Settings/+/63d464c3fa5c7b9900448fef3844790756e557eb"
},
{
"tags": [
"x_transferred"
],
"url": "https://source.android.com/security/bulletin/2023-10-01"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-40125",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-23T13:26:09.464154Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-noinfo Not enough information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-05-05T14:59:00.509Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android",
"vendor": "Google",
"versions": [
{
"status": "affected",
"version": "13"
},
{
"status": "affected",
"version": "12L"
},
{
"status": "affected",
"version": "12"
},
{
"status": "affected",
"version": "11"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In onCreate of ApnEditor.java, there is a possible way for a Guest user to change the APN due to a permission bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Elevation of privilege",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-27T20:22:57.089Z",
"orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"shortName": "google_android"
},
"references": [
{
"url": "https://android.googlesource.com/platform/packages/apps/Settings/+/63d464c3fa5c7b9900448fef3844790756e557eb"
},
{
"url": "https://source.android.com/security/bulletin/2023-10-01"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"assignerShortName": "google_android",
"cveId": "CVE-2023-40125",
"datePublished": "2023-10-27T20:22:57.089Z",
"dateReserved": "2023-08-09T02:29:33.868Z",
"dateUpdated": "2025-05-05T14:59:00.509Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-40127 (GCVE-0-2023-40127)
Vulnerability from cvelistv5 – Published: 2023-10-27 20:22 – Updated: 2024-09-09 14:45
VLAI
EPSS
VEX
Summary
In multiple locations, there is a possible way to access screenshots due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- Information disclosure
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:24:55.607Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://android.googlesource.com/platform/packages/providers/MediaProvider/+/747431250612507e8289ae8eb1a56303e79ab678"
},
{
"tags": [
"x_transferred"
],
"url": "https://source.android.com/security/bulletin/2023-10-01"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-40127",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-09T14:45:37.325429Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-09T14:45:48.814Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android",
"vendor": "Google",
"versions": [
{
"status": "affected",
"version": "13"
},
{
"status": "affected",
"version": "12L"
},
{
"status": "affected",
"version": "12"
},
{
"status": "affected",
"version": "11"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In multiple locations, there is a possible way to access screenshots due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Information disclosure",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-27T20:22:57.293Z",
"orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"shortName": "google_android"
},
"references": [
{
"url": "https://android.googlesource.com/platform/packages/providers/MediaProvider/+/747431250612507e8289ae8eb1a56303e79ab678"
},
{
"url": "https://source.android.com/security/bulletin/2023-10-01"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"assignerShortName": "google_android",
"cveId": "CVE-2023-40127",
"datePublished": "2023-10-27T20:22:57.293Z",
"dateReserved": "2023-08-09T02:29:33.869Z",
"dateUpdated": "2024-09-09T14:45:48.814Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-40128 (GCVE-0-2023-40128)
Vulnerability from cvelistv5 – Published: 2023-10-27 20:22 – Updated: 2024-09-09 14:44
VLAI
EPSS
VEX
Summary
In several functions of xmlregexp.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- Elevation of privilege
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:24:55.442Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://android.googlesource.com/platform/external/libxml2/+/1ccf89b87a3969edd56956e2d447f896037c8be7"
},
{
"tags": [
"x_transferred"
],
"url": "https://source.android.com/security/bulletin/2023-10-01"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:o:google:android:11.0:-:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "android",
"vendor": "google",
"versions": [
{
"status": "affected",
"version": "11.0"
},
{
"status": "affected",
"version": "12.0"
},
{
"status": "affected",
"version": "12l"
},
{
"status": "affected",
"version": "13.0"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-40128",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-09T14:42:23.625882Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-09T14:44:35.111Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android",
"vendor": "Google",
"versions": [
{
"status": "affected",
"version": "13"
},
{
"status": "affected",
"version": "12L"
},
{
"status": "affected",
"version": "12"
},
{
"status": "affected",
"version": "11"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In several functions of xmlregexp.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Elevation of privilege",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-27T20:22:57.517Z",
"orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"shortName": "google_android"
},
"references": [
{
"url": "https://android.googlesource.com/platform/external/libxml2/+/1ccf89b87a3969edd56956e2d447f896037c8be7"
},
{
"url": "https://source.android.com/security/bulletin/2023-10-01"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"assignerShortName": "google_android",
"cveId": "CVE-2023-40128",
"datePublished": "2023-10-27T20:22:57.517Z",
"dateReserved": "2023-08-09T02:29:33.869Z",
"dateUpdated": "2024-09-09T14:44:35.111Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-40129 (GCVE-0-2023-40129)
Vulnerability from cvelistv5 – Published: 2023-10-27 20:22 – Updated: 2024-09-09 14:41
VLAI
EPSS
VEX
Summary
In build_read_multi_rsp of gatt_sr.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- Remote code execution
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:24:55.527Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/c0151aa3ba76c785b32c7f9d16c98febe53017b1"
},
{
"tags": [
"x_transferred"
],
"url": "https://source.android.com/security/bulletin/2023-10-01"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "android",
"vendor": "google",
"versions": [
{
"status": "affected",
"version": "12.0"
},
{
"status": "affected",
"version": "12l"
},
{
"status": "affected",
"version": "13.0"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-40129",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-09T14:37:30.229093Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-09T14:41:13.584Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android",
"vendor": "Google",
"versions": [
{
"status": "affected",
"version": "13"
},
{
"status": "affected",
"version": "12L"
},
{
"status": "affected",
"version": "12"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In build_read_multi_rsp of gatt_sr.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Remote code execution",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-27T20:22:57.693Z",
"orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"shortName": "google_android"
},
"references": [
{
"url": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/c0151aa3ba76c785b32c7f9d16c98febe53017b1"
},
{
"url": "https://source.android.com/security/bulletin/2023-10-01"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"assignerShortName": "google_android",
"cveId": "CVE-2023-40129",
"datePublished": "2023-10-27T20:22:57.693Z",
"dateReserved": "2023-08-09T02:29:33.869Z",
"dateUpdated": "2024-09-09T14:41:13.584Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-40130 (GCVE-0-2023-40130)
Vulnerability from cvelistv5 – Published: 2023-10-27 20:22 – Updated: 2025-12-17 15:57
VLAI
EPSS
VEX
Summary
In notifyTimeout of CallRedirectionProcessor, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege and background activity launch with no additional execution privileges needed. User interaction is not needed for exploitation.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- Elevation of privilege
Assigner
References
4 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Android |
Affected:
16
Affected: 15 Affected: 14 Affected: 13 |
||
| android |
Affected:
11.0
Affected: 12.0 Affected: 12.0l Affected: 13.0 cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:* cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:* cpe:2.3:o:google:android:12.0l:*:*:*:*:*:*:* cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:24:55.525Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://android.googlesource.com/platform/packages/services/Telecomm/+/5b335401d1c8de7d1c85f4a0cf353f7f9fc30218"
},
{
"tags": [
"x_transferred"
],
"url": "https://source.android.com/security/bulletin/2023-10-01"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:*",
"cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:*",
"cpe:2.3:o:google:android:12.0l:*:*:*:*:*:*:*",
"cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "android",
"vendor": "google",
"versions": [
{
"status": "affected",
"version": "11.0"
},
{
"status": "affected",
"version": "12.0"
},
{
"status": "affected",
"version": "12.0l"
},
{
"status": "affected",
"version": "13.0"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-40130",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-09T19:42:40.984572Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-09T19:46:05.580Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android",
"vendor": "Google",
"versions": [
{
"status": "affected",
"version": "16"
},
{
"status": "affected",
"version": "15"
},
{
"status": "affected",
"version": "14"
},
{
"status": "affected",
"version": "13"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In notifyTimeout of CallRedirectionProcessor, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege and background activity launch with no additional execution privileges needed. User interaction is not needed for exploitation."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Elevation of privilege",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-17T15:57:10.217Z",
"orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"shortName": "google_android"
},
"references": [
{
"url": "https://android.googlesource.com/platform/packages/services/Telecomm/+/a43a880beaa6a64348a1d0c821e8c7e98d741a79"
},
{
"url": "https://source.android.com/security/bulletin/2025-12-01"
}
],
"x_generator": {
"engine": "cvelib 1.7.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"assignerShortName": "google_android",
"cveId": "CVE-2023-40130",
"datePublished": "2023-10-27T20:22:57.878Z",
"dateReserved": "2023-08-09T02:29:33.869Z",
"dateUpdated": "2025-12-17T15:57:10.217Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-40131 (GCVE-0-2023-40131)
Vulnerability from cvelistv5 – Published: 2023-10-27 20:22 – Updated: 2025-04-30 20:17
VLAI
EPSS
VEX
Summary
In GpuService of GpuService.cpp, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- Elevation of privilege
- CWE-416 - Use After Free
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:24:55.569Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://android.googlesource.com/platform/frameworks/native/+/0cda11569dd256ff3220b4fe44f861f8081d7116"
},
{
"tags": [
"x_transferred"
],
"url": "https://source.android.com/security/bulletin/2023-10-01"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-40131",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-23T13:26:07.806307Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-30T20:17:44.180Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android",
"vendor": "Google",
"versions": [
{
"status": "affected",
"version": "13"
},
{
"status": "affected",
"version": "12L"
},
{
"status": "affected",
"version": "12"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In GpuService of GpuService.cpp, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Elevation of privilege",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-27T20:22:58.077Z",
"orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"shortName": "google_android"
},
"references": [
{
"url": "https://android.googlesource.com/platform/frameworks/native/+/0cda11569dd256ff3220b4fe44f861f8081d7116"
},
{
"url": "https://source.android.com/security/bulletin/2023-10-01"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"assignerShortName": "google_android",
"cveId": "CVE-2023-40131",
"datePublished": "2023-10-27T20:22:58.077Z",
"dateReserved": "2023-08-09T02:29:33.869Z",
"dateUpdated": "2025-04-30T20:17:44.180Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-40133 (GCVE-0-2023-40133)
Vulnerability from cvelistv5 – Published: 2023-10-27 20:22 – Updated: 2024-09-09 19:42
VLAI
EPSS
VEX
Summary
In multiple locations of DialogFillUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- Information disclosure
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:24:55.401Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://android.googlesource.com/platform/frameworks/base/+/08becc8c600f14c5529115cc1a1e0c97cd503f33"
},
{
"tags": [
"x_transferred"
],
"url": "https://source.android.com/security/bulletin/2023-10-01"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-40133",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-09T19:42:05.799419Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-09T19:42:17.245Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android",
"vendor": "Google",
"versions": [
{
"status": "affected",
"version": "13"
},
{
"status": "affected",
"version": "12L"
},
{
"status": "affected",
"version": "12"
},
{
"status": "affected",
"version": "11"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In multiple locations of DialogFillUi.java, there is a possible way to view another user\u0027s images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Information disclosure",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-27T20:22:58.290Z",
"orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"shortName": "google_android"
},
"references": [
{
"url": "https://android.googlesource.com/platform/frameworks/base/+/08becc8c600f14c5529115cc1a1e0c97cd503f33"
},
{
"url": "https://source.android.com/security/bulletin/2023-10-01"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"assignerShortName": "google_android",
"cveId": "CVE-2023-40133",
"datePublished": "2023-10-27T20:22:58.290Z",
"dateReserved": "2023-08-09T02:29:36.075Z",
"dateUpdated": "2024-09-09T19:42:17.245Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-40134 (GCVE-0-2023-40134)
Vulnerability from cvelistv5 – Published: 2023-10-27 20:22 – Updated: 2024-09-09 19:41
VLAI
EPSS
VEX
Summary
In isFullScreen of FillUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- Information disclosure
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:24:55.517Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://android.googlesource.com/platform/frameworks/base/+/08becc8c600f14c5529115cc1a1e0c97cd503f33"
},
{
"tags": [
"x_transferred"
],
"url": "https://source.android.com/security/bulletin/2023-10-01"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-40134",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-09T19:41:29.059431Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-09T19:41:38.400Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android",
"vendor": "Google",
"versions": [
{
"status": "affected",
"version": "13"
},
{
"status": "affected",
"version": "12L"
},
{
"status": "affected",
"version": "12"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In isFullScreen of FillUi.java, there is a possible way to view another user\u0027s images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Information disclosure",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-27T20:22:58.463Z",
"orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"shortName": "google_android"
},
"references": [
{
"url": "https://android.googlesource.com/platform/frameworks/base/+/08becc8c600f14c5529115cc1a1e0c97cd503f33"
},
{
"url": "https://source.android.com/security/bulletin/2023-10-01"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"assignerShortName": "google_android",
"cveId": "CVE-2023-40134",
"datePublished": "2023-10-27T20:22:58.463Z",
"dateReserved": "2023-08-09T02:29:36.075Z",
"dateUpdated": "2024-09-09T19:41:38.400Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-40135 (GCVE-0-2023-40135)
Vulnerability from cvelistv5 – Published: 2023-10-27 20:22 – Updated: 2024-09-09 19:41
VLAI
EPSS
VEX
Summary
In applyCustomDescription of SaveUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- Information disclosure
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:24:55.575Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://android.googlesource.com/platform/frameworks/base/+/08becc8c600f14c5529115cc1a1e0c97cd503f33"
},
{
"tags": [
"x_transferred"
],
"url": "https://source.android.com/security/bulletin/2023-10-01"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-40135",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-09T19:40:49.285066Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-09T19:41:08.331Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android",
"vendor": "Google",
"versions": [
{
"status": "affected",
"version": "13"
},
{
"status": "affected",
"version": "12L"
},
{
"status": "affected",
"version": "12"
},
{
"status": "affected",
"version": "11"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In applyCustomDescription of SaveUi.java, there is a possible way to view another user\u0027s images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Information disclosure",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-27T20:22:58.641Z",
"orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"shortName": "google_android"
},
"references": [
{
"url": "https://android.googlesource.com/platform/frameworks/base/+/08becc8c600f14c5529115cc1a1e0c97cd503f33"
},
{
"url": "https://source.android.com/security/bulletin/2023-10-01"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"assignerShortName": "google_android",
"cveId": "CVE-2023-40135",
"datePublished": "2023-10-27T20:22:58.641Z",
"dateReserved": "2023-08-09T02:29:36.075Z",
"dateUpdated": "2024-09-09T19:41:08.331Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-40136 (GCVE-0-2023-40136)
Vulnerability from cvelistv5 – Published: 2023-10-27 20:22 – Updated: 2024-09-09 19:40
VLAI
EPSS
VEX
Summary
In setHeader of DialogFillUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- Information disclosure
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:24:55.518Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://android.googlesource.com/platform/frameworks/base/+/08becc8c600f14c5529115cc1a1e0c97cd503f33"
},
{
"tags": [
"x_transferred"
],
"url": "https://source.android.com/security/bulletin/2023-10-01"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-40136",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-09T19:40:18.831586Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-09T19:40:31.470Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android",
"vendor": "Google",
"versions": [
{
"status": "affected",
"version": "13"
},
{
"status": "affected",
"version": "12L"
},
{
"status": "affected",
"version": "12"
},
{
"status": "affected",
"version": "11"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In setHeader of DialogFillUi.java, there is a possible way to view another user\u0027s images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Information disclosure",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-27T20:22:58.825Z",
"orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"shortName": "google_android"
},
"references": [
{
"url": "https://android.googlesource.com/platform/frameworks/base/+/08becc8c600f14c5529115cc1a1e0c97cd503f33"
},
{
"url": "https://source.android.com/security/bulletin/2023-10-01"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"assignerShortName": "google_android",
"cveId": "CVE-2023-40136",
"datePublished": "2023-10-27T20:22:58.825Z",
"dateReserved": "2023-08-09T02:29:36.075Z",
"dateUpdated": "2024-09-09T19:40:31.470Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…