CVSS: 7.7EPSS: 0%CPEs: 4EXPL: 0CVE-2024-34740
https://notcve.org/view.php?id=CVE-2024-34740
In attributeBytesBase64 and attributeBytesHex of BinaryXmlSerializer.java, there is a possible arbitrary XML injection due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. • https://android.googlesource.com/platform/frameworks/base/+/e8b6505647be558ed3a167a1e13c53dfc227d22b https://android.googlesource.com/platform/frameworks/libs/modules-utils/+/700c28908051ceb55e1456d2d21229bc17c6895a https://source.android.com/security/bulletin/2024-08-01 • CWE-91: XML Injection (aka Blind XPath Injection) CWE-190: Integer Overflow or Wraparound •
CVSS: 7.7EPSS: 0%CPEs: 4EXPL: 1CVE-2024-34739
https://notcve.org/view.php?id=CVE-2024-34739
In shouldRestrictOverlayActivities of UsbProfileGroupSettingsManager.java, there is a possible escape from SUW due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. • https://github.com/uthrasri/CVE-2024-34739 https://android.googlesource.com/platform/frameworks/base/+/50e1f8f36e32928d10e72324c05a203a6db9f7fb https://source.android.com/security/bulletin/2024-08-01 • CWE-116: Improper Encoding or Escaping of Output •
CVSS: 7.7EPSS: 0%CPEs: 2EXPL: 0CVE-2024-34738
https://notcve.org/view.php?id=CVE-2024-34738
In multiple functions of AppOpsService.java, there is a possible way for unprivileged apps to read their own restrictRead app-op states due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. • https://android.googlesource.com/platform/frameworks/base/+/21d764807b3dcd402d63e2b4c9fbae1c9965400a https://source.android.com/security/bulletin/2024-08-01 •
CVSS: 7.7EPSS: 0%CPEs: 4EXPL: 0CVE-2024-34737
https://notcve.org/view.php?id=CVE-2024-34737
In ensureSetPipAspectRatioQuotaTracker of ActivityClientController.java, there is a possible way to generate unmovable and undeletable pip windows due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. • https://android.googlesource.com/platform/frameworks/base/+/8b473b3f79642f42eeeffbfe572df6c6cbe9d79e https://source.android.com/security/bulletin/2024-08-01 •
CVSS: 6.2EPSS: 0%CPEs: 4EXPL: 0CVE-2024-34736
https://notcve.org/view.php?id=CVE-2024-34736
In setupVideoEncoder of StagefrightRecorder.cpp, there is a possible asynchronous playback when B-frame support is enabled. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. • https://android.googlesource.com/platform/frameworks/av/+/6cfd048292b2cc706811a22c9078208cfa8e6d24 https://source.android.com/security/bulletin/2024-08-01 •