CVSS: 6.2EPSS: 0%CPEs: 4EXPL: 0CVE-2024-0019
https://notcve.org/view.php?id=CVE-2024-0019
16 Feb 2024 — In setListening of AppOpsControllerImpl.java, there is a possible way to hide the microphone privacy indicator when restarting systemUI due to a missing check for active recordings. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation. En setListening de AppOpsControllerImpl.java, existe una forma posible de ocultar el indicador de privacidad del micrófono al reiniciar la UI del sistema debido a que falta una verificación de g... • https://android.googlesource.com/platform/frameworks/base/+/707fc94ec3df4cf6b985e6d06c2588690d1a025a • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 8.4EPSS: 0%CPEs: 5EXPL: 0CVE-2024-0018
https://notcve.org/view.php?id=CVE-2024-0018
16 Feb 2024 — In convertYUV420Planar16ToY410 of ColorConverter.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. En convertYUV420Planar16ToY410 de ColorConverter.cpp, existe una posible escritura fuera de los límites debido a un desbordamiento de búfer de almacenamiento dinámico. Esto podría conducir a una escalada local de privilegios sin necesidad de... • https://android.googlesource.com/platform/frameworks/av/+/bf6406041919f67219fd1829438dda28845d4c23 • CWE-122: Heap-based Buffer Overflow •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2024-0017
https://notcve.org/view.php?id=CVE-2024-0017
16 Feb 2024 — In shouldUseNoOpLocation of CameraActivity.java, there is a possible confused deputy due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. En shouldUseNoOpLocation of CameraActivity.java, hay un posible adjunto confundido debido a una omisión de permisos. Esto podría dar lugar a la divulgación de información local sin necesidad de privilegios de ejecución adicionales. • https://android.googlesource.com/platform/packages/apps/Camera2/+/5c4c4b35754eef319dcd69c422f0b1ac0c823f6e • CWE-863: Incorrect Authorization •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2024-0016
https://notcve.org/view.php?id=CVE-2024-0016
16 Feb 2024 — In multiple locations, there is a possible out of bounds read due to a missing bounds check. This could lead to paired device information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. En varias ubicaciones, existe una posible lectura fuera de los límites debido a una verificación de los límites faltantes. Esto podría dar lugar a la divulgación de información del dispositivo emparejado sin necesidad de privilegios de ejecución adicionales. • https://android.googlesource.com/platform/packages/modules/Bluetooth/+/1d7ba7c8a205522f384e8d5c7c9f26a421cab5f1 • CWE-125: Out-of-bounds Read •
CVSS: 7.8EPSS: 3%CPEs: 4EXPL: 1CVE-2024-0015
https://notcve.org/view.php?id=CVE-2024-0015
16 Feb 2024 — In convertToComponentName of DreamService.java, there is a possible way to launch arbitrary protected activities due to intent redirection. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. En convertToComponentName de DreamService.java, existe una forma posible de iniciar actividades protegidas arbitrarias debido a la redirección de intención. Esto podría conducir a una escalada local de privilegios con permisos de ejecu... • https://github.com/UmVfX1BvaW50/CVE-2024-0015 • CWE-280: Improper Handling of Insufficient Permissions or Privileges •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-40085
https://notcve.org/view.php?id=CVE-2023-40085
16 Feb 2024 — In convertSubgraphFromHAL of ShimConverter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. En convertSubgraphFromHAL de ShimConverter.cpp, existe una posible lectura fuera de los límites debido a una verificación de los límites faltantes. Esto podría dar lugar a la divulgación de información local sin necesidad de privilegios de ejecución... • https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/ed6ee1f7eca7b33160e36ac6d730a9ef395ca4f1 • CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 18%CPEs: 5EXPL: 2CVE-2024-0040
https://notcve.org/view.php?id=CVE-2024-0040
16 Feb 2024 — In setParameter of MtpPacket.cpp, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. En setParameter de MtpPacket.cpp, existe una posible lectura fuera de los límites debido a un desbordamiento de búfer de almacenamiento dinámico. Esto podría conducir a la divulgación remota de información sin necesidad de privilegios de ejecución adicionales. • https://github.com/nidhihcl75/frameworks_av_AOSP10_r33_CVE-2024-0040 • CWE-122: Heap-based Buffer Overflow •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2024-0037
https://notcve.org/view.php?id=CVE-2024-0037
16 Feb 2024 — In applyCustomDescription of SaveUi.java, there is a possible way to view images belonging to a different user due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation. En applyCustomDescription de SaveUi.java, existe una forma posible de ver imágenes que pertenecen a un usuario diferente debido a que falta una verificación de permiso. Esto podría dar lugar a la divulgación de información local c... • https://android.googlesource.com/platform/frameworks/base/+/55fc00a0788ea0995fe0851616b9ac21710a2931 • CWE-862: Missing Authorization CWE-922: Insecure Storage of Sensitive Information •
CVSS: 7.4EPSS: 0%CPEs: 5EXPL: 0CVE-2024-0036
https://notcve.org/view.php?id=CVE-2024-0036
16 Feb 2024 — In startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible way to bypass the restrictions on starting activities from the background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. En startNextMatchingActivity de ActivityTaskManagerService.java, existe una forma posible de evitar las restricciones para iniciar actividades desde segundo plano debido a u... • https://android.googlesource.com/platform/frameworks/base/+/3eaaa9687e90c65f51762deb343f18bef95d4e8e • CWE-284: Improper Access Control •
CVSS: 7.4EPSS: 0%CPEs: 5EXPL: 0CVE-2024-0035
https://notcve.org/view.php?id=CVE-2024-0035
16 Feb 2024 — In onNullBinding of TileLifecycleManager.java, there is a possible way to launch an activity from the background due to a missing null check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. En onNullBinding de TileLifecycleManager.java, existe una forma posible de iniciar una actividad desde segundo plano debido a que falta una verificación nula. Esto podría conducir a una escalada local de privilegios sin nece... • https://android.googlesource.com/platform/frameworks/base/+/7b7fff1eb5014d12200a32ff9047da396c7ab6a4 • CWE-476: NULL Pointer Dereference •