CVSS: 8.8EPSS: 0%CPEs: 11EXPL: 2CVE-2013-6271
https://notcve.org/view.php?id=CVE-2013-6271
Android 4.0 through 4.3 allows attackers to bypass intended access restrictions and remove device locks via a crafted application that invokes the updateUnlockMethodAndFinish method in the com.android.settings.ChooseLockGeneric class with the PASSWORD_QUALITY_UNSPECIFIED option. Android 4.0 a 4.3, permite a atacantes eludir las restricciones de acceso previstas y eliminar los bloqueos del dispositivo a través de una aplicación manipulada que invoca el método updateUnlockMethodAndFinish en la clase com.android.settings.ChooseLockGeneric con la opción PASSWORD_QUALITY_UNSPECIFIED. • http://seclists.org/fulldisclosure/2013/Nov/204 http://www.securitytracker.com/id/1029410 http://www.theregister.co.uk/2013/12/10/android_has_lockbypass_bug https://cureblog.de/2013/11/cve-2013-6271-remove-device-locks-from-android-phone • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 10.0EPSS: 0%CPEs: 117EXPL: 1CVE-2013-6774 – Android 4.2.x Superuser Unsanitized Environment
https://notcve.org/view.php?id=CVE-2013-6774
Untrusted search path vulnerability in the ChainsDD Superuser package 3.1.3 for Android 4.2.x and earlier, CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android 4.2.x and earlier, and Chainfire SuperSU package before 1.69 for Android 4.2.x and earlier allows attackers to load an arbitrary .jar file and gain privileges via a crafted BOOTCLASSPATH environment variable for a /system/xbin/su process. NOTE: another researcher was unable to reproduce this with ChainsDD Superuser. Vulnerabilidad de búsqueda de ruta no confiable en el paquete ChainsDD Superuser 3.1.3 para Android 4.2.x y anteriores, el paquete CyanogenMod/ClockWorkMod/Koush Superuser 1.0.2.1 para Android 4.2.x y anteriores y el paquete Chainfire SuperSU anterior a 1.69 para Android 4.2.x y anteriores permite a atacantes cargar un archivo .jar arbitrario y ganar privilegios a través de una variable de entorno BOOTCLASSPATH manipulada para un proceso /system/xbin/su. NOTA: otro investigador fue incapaz de reproducir esto con ChainsDD Superuser. Vulnerable releases of several common Android Superuser packages may allow malicious Android applications to execute arbitrary commands as root without notifying the device owner. • http://www.securityfocus.com/archive/1/529796 http://www.securityfocus.com/archive/1/529822 •
CVSS: 5.0EPSS: 0%CPEs: 39EXPL: 1CVE-2013-6768 – Android 4.2.x Superuser Unsanitized Environment
https://notcve.org/view.php?id=CVE-2013-6768
Untrusted search path vulnerability in the CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android 4.2.x and earlier allows attackers to trigger the launch of a Trojan horse app_process program via a crafted PATH environment variable for a /system/xbin/su process. Vulnerabilidad de búsqueda de ruta no confiable en el paquete CyanogenMod/ClockWorkMod/Koush Superuser 1.0.2.1 para Android 4.2.x y anteriores permite a atacantes provocar el lanzamiento de un programa app_process caballo de troya a través de una variable de entorno PATH manipulada para un proceso /system/xbin/su. Vulnerable releases of several common Android Superuser packages may allow malicious Android applications to execute arbitrary commands as root without notifying the device owner. This advisoriy documents PATH and BOOTCLASSPATH vulnerabilities. • http://www.securityfocus.com/archive/1/529796 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 10.0EPSS: 7%CPEs: 13EXPL: 0CVE-2013-3363 – flash-plugin: multiple code execution flaws (APSB13-21)
https://notcve.org/view.php?id=CVE-2013-3363
Adobe Flash Player before 11.7.700.242 and 11.8.x before 11.8.800.168 on Windows and Mac OS X, before 11.2.202.310 on Linux, before 11.1.111.73 on Android 2.x and 3.x, and before 11.1.115.81 on Android 4.x; Adobe AIR before 3.8.0.1430; and Adobe AIR SDK & Compiler before 3.8.0.1430 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-3361, CVE-2013-3362, and CVE-2013-5324. Adobe Flash Player anteriores a 11.7.700.242 y 11.8.x (anteriores a 11.8.800.168) en Windows y Mac OS X, anterior a 11.2.202.310 en Linux, anterior a 11.1.111.73 en Android 2.x y 3.x, y anterior a 11.1.115.81 en Android 4.x; Adobe AIR SDK y Compilador anterior a 3.8.0.1430 permite a un atacante ejecutar código a discrección o causar una denegación de servicio (corrupción de memoria) a través de vectores no especificados, una vulnerabilidad diferente a CVE-2013-3361, CVE-2013-3362, y CVE-2013-5324. • http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00002.html http://lists.opensuse.org/opensuse-updates/2013-09/msg00040.html http://rhn.redhat.com/errata/RHSA-2013-1256.html http://www.adobe.com/support/security/bulletins/apsb13-21.html https://access.redhat.com/security/cve/CVE-2013-3363 https://bugzilla.redhat.com/show_bug.cgi?id=1006496 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 10.0EPSS: 7%CPEs: 13EXPL: 0CVE-2013-5324 – flash-plugin: multiple code execution flaws (APSB13-21)
https://notcve.org/view.php?id=CVE-2013-5324
Adobe Flash Player before 11.7.700.242 and 11.8.x before 11.8.800.168 on Windows and Mac OS X, before 11.2.202.310 on Linux, before 11.1.111.73 on Android 2.x and 3.x, and before 11.1.115.81 on Android 4.x; Adobe AIR before 3.8.0.1430; and Adobe AIR SDK & Compiler before 3.8.0.1430 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-3361, CVE-2013-3362, and CVE-2013-3363. Adobe Flash Player anterior a 11.7.700.242 y 11.8.x anterior a 11.8.800.168 en Windows y Mac OS X, anterior a 11.2.202.310 en Linux, anterior a 11.1.111.73 en Android 2.x y 3.x, y anteriores, 11.1.115.81 en Android 4.x; Adobe AIR anterior a 3.8.0.1430; y Adobe AIR SDK & Compiler anterior a 3.8.0.1430 permite a atacantes ejecutar código arbitrario o causar denegación de servicio (corrupción de memoria) a través de vectores sin especificar. Vulnerabilidad diferente a CVE-2013-3361, CVE-2013-3362, and CVE-2013-3363. • http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00002.html http://lists.opensuse.org/opensuse-updates/2013-09/msg00040.html http://rhn.redhat.com/errata/RHSA-2013-1256.html http://www.adobe.com/support/security/bulletins/apsb13-21.html https://access.redhat.com/security/cve/CVE-2013-5324 https://bugzilla.redhat.com/show_bug.cgi?id=1006496 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •