CVSS: 6.3EPSS: 0%CPEs: 28EXPL: 0CVE-2023-45866 – bluez: unauthorized HID device connections allows keystroke injection and arbitrary commands execution
https://notcve.org/view.php?id=CVE-2023-45866
Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports, potentially permitting injection of HID messages when no user interaction has occurred in the Central role to authorize such access. An example affected package is bluez 5.64-0ubuntu1 in Ubuntu 22.04LTS. NOTE: in some cases, a CVE-2020-0556 mitigation would have already addressed this Bluetooth HID Hosts issue. Bluetooth HID Hosts in BlueZ pueden permitir que un dispositivo HID con función periférica no autenticada inicie y establezca una conexión cifrada y acepte informes de teclado HID, lo que potencialmente permite la inyección de mensajes HID cuando no se ha producido ninguna interacción del usuario en la función central para autorizar dicho acceso. Un ejemplo de paquete afectado es bluez 5.64-0ubuntu1 en Ubuntu 22.04LTS. • http://changelogs.ubuntu.com/changelogs/pool/main/b/bluez/bluez_5.64-0ubuntu1/changelog http://seclists.org/fulldisclosure/2023/Dec/7 http://seclists.org/fulldisclosure/2023/Dec/9 https://bluetooth.com https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/profiles/input?id=25a471a83e02e1effb15d5a488b3f0085eaeb675 https://github.com/skysafe/reblog/tree/main/cve-2023-45866 https://lists.debian.org/debian-lts-announce/2023/12/msg00011.html https://lists.fedoraproject.org/archives/list/package • CWE-285: Improper Authorization CWE-287: Improper Authentication •
CVSS: 5.8EPSS: 0%CPEs: 3EXPL: 0CVE-2018-10229
https://notcve.org/view.php?id=CVE-2018-10229
A hardware vulnerability in GPU memory modules allows attackers to accelerate micro-architectural attacks through the use of the JavaScript WebGL API. Una vulnerabilidad de hardware en los módulos de memoria de la GPU permiten que atacantes aceleren los ataques microarquitectónicos a través del uso de la API WebGL de JavaScript. • http://www.securityfocus.com/bid/104084 https://www.kb.cert.org/vuls/id/283803 https://www.vusec.net/wp-content/uploads/2018/05/glitch.pdf • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2016-6684
https://notcve.org/view.php?id=CVE-2016-6684
The kernel in Android before 2016-10-05 on Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Nexus Player, and Android One devices allows attackers to obtain sensitive information via a crafted application, aka internal bug 30148243. El kernel en Android en versiones anteriores a 2016-10-05 en dispositivos Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Nexus Player y Android One permite a atacantes obtener información sensible a través de una aplicación manipulada, vulnerabilidad también conocida como error interno 30148243. • http://source.android.com/security/bulletin/2016-10-01.html http://www.securityfocus.com/bid/93326 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2014-9888
https://notcve.org/view.php?id=CVE-2014-9888
arch/arm/mm/dma-mapping.c in the Linux kernel before 3.13 on ARM platforms, as used in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices, does not prevent executable DMA mappings, which might allow local users to gain privileges via a crafted application, aka Android internal bug 28803642 and Qualcomm internal bug CR642735. arch/arm/mm/dma-mapping.c en el kernel de Linux en versiones anteriores 3.13 en las plataformas ARM, como se utiliza en Android en versiones anteriores a 2016-08-05 en dispositivos Nexus 5 y 7 (2013), no impide asignaciones DMA ejecutables, lo que permite a usuarios locales obtener privilegios a través de una aplicacion manipulada, también conocido como error interno de Android 28803642 y error interno de Qualcomm CR642735. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=0ea1ec713f04bdfac343c9702b21cd3a7c711826 http://source.android.com/security/bulletin/2016-08-01.html http://www.securityfocus.com/bid/92219 https://github.com/torvalds/linux/commit/0ea1ec713f04bdfac343c9702b21cd3a7c711826 https://source.codeaurora.org/quic/la/kernel/msm/commit/?id=f044936caab337a4384fbfe64a4cbae33c7e22a1 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.3EPSS: 0%CPEs: 4EXPL: 0CVE-2016-2432
https://notcve.org/view.php?id=CVE-2016-2432
The Qualcomm TrustZone component in Android before 2016-05-01 on Nexus 6 and Android One devices allows attackers to gain privileges via a crafted application, aka internal bug 25913059. El componente Qualcomm TrustZone en Android en versiones anteriores a 2016-05-01 sobre dispositivos Nexus 6 y Android One permite a atacantes obtener privilegios a través de una aplicación manipulada, también conocido como error interno 25913059. • http://source.android.com/security/bulletin/2016-05-01.html • CWE-264: Permissions, Privileges, and Access Controls •