CVSS: 7.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-0460 – Remote code execution in YouTube Android Player API SDK
https://notcve.org/view.php?id=CVE-2023-0460
The YouTube Embedded 1.2 SDK binds to a service within the YouTube Main App. After binding, a remote context is created with the flags Context.CONTEXT_INCLUDE_CODE | Context.CONTEXT_IGNORE_SECURITY. This allows the client app to remotely load code from YouTube Main App by retrieving the Main App’s ClassLoader. A potential vulnerability in the binding logic used by the client SDK where the SDK ends up calling bindService() on a malicious app rather than YT Main App. This creates a vulnerability where the SDK can load the malicious app’s ClassLoader instead, allowing the malicious app to load arbitrary code into the calling app whenever the embedded SDK is invoked. In order to trigger this vulnerability, an attacker must masquerade the Youtube app and install it on a device, have a second app that uses the Embedded player and typically distribute both to the victim outside of the Play Store. • https://developers.google.com/youtube/android/player/downloads • CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') •
CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 0CVE-2016-2427
https://notcve.org/view.php?id=CVE-2016-2427
The AES-GCM specification in RFC 5084, as used in Android 5.x and 6.x, recommends 12 octets for the aes-ICVlen parameter field, which might make it easier for attackers to defeat a cryptographic protection mechanism and discover an authentication key via a crafted application, aka internal bug 26234568. NOTE: The vendor disputes the existence of this potential issue in Android, stating "This CVE was raised in error: it referred to the authentication tag size in GCM, whose default according to ASN.1 encoding (12 bytes) can lead to vulnerabilities. After careful consideration, it was decided that the insecure default value of 12 bytes was a default only for the encoding and not default anywhere else in Android, and hence no vulnerability existed. **DISPUTADA** La especificación AES-GCM en RFC 5084,como es utilizado en Android 5.x y 6.x, recomienda 12 octetos para el campo de parámetro aes-ICVlen, lo que podría facilitar a atacantes derrotar el mecanismo de protección criptográfico y descubrir una clave de autenticación a través de una aplicación manipulada, también conocido como error interno 26234568. NOTA: El vendedor disputa la existencia de este potencial problema en Android, indicando que "Esta CVE fue levantada por error: se refería al tamaño de la etiqueta de autenticación en GCM, cuyo defecto de acuerdo con la codificación ASN.1 (12 bytes) puede llevar a vulnerabilidades. • http://source.android.com/security/bulletin/2016-04-02.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.8EPSS: 4%CPEs: 16EXPL: 2CVE-2012-6636 – Google Android 4.2 Browser and WebView - 'addJavascriptInterface' Code Execution
https://notcve.org/view.php?id=CVE-2012-6636
The Android API before 17 does not properly restrict the WebView.addJavascriptInterface method, which allows remote attackers to execute arbitrary methods of Java objects by using the Java Reflection API within crafted JavaScript code that is loaded into the WebView component in an application targeted to API level 16 or earlier, a related issue to CVE-2013-4710. La API Android anterior a 17 no restringe debidamente el método WebView.addJavascriptInterface, lo que permite a atacantes remotos ejecutar métodos arbitrarios de objetos Java mediante el uso de la API Java Reflection dentro de código JavaScript manipulado que es subido en el componente WebView en una aplicación dirigida a API nivel 16 o anteriores, un problema relacionado con CVE-2013-4710. • https://www.exploit-db.com/exploits/41675 http://50.56.33.56/blog/?p=314 http://developer.android.com/reference/android/os/Build.VERSION_CODES.html#JELLY_BEAN_MR1 http://developer.android.com/reference/android/webkit/WebView.html#addJavascriptInterface%28java.lang.Object%2C%20java.lang.String%29 http://jvn.jp/en/jp/JVN62161191/index.html http://openwall.com/lists/oss-security/2014/02/07/9 http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf http://www.internetsociety.org&# • CWE-264: Permissions, Privileges, and Access Controls •