CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2024-0016
https://notcve.org/view.php?id=CVE-2024-0016
16 Feb 2024 — In multiple locations, there is a possible out of bounds read due to a missing bounds check. This could lead to paired device information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. En varias ubicaciones, existe una posible lectura fuera de los límites debido a una verificación de los límites faltantes. Esto podría dar lugar a la divulgación de información del dispositivo emparejado sin necesidad de privilegios de ejecución adicionales. • https://android.googlesource.com/platform/packages/modules/Bluetooth/+/1d7ba7c8a205522f384e8d5c7c9f26a421cab5f1 • CWE-125: Out-of-bounds Read •
CVSS: 7.8EPSS: 3%CPEs: 4EXPL: 1CVE-2024-0015
https://notcve.org/view.php?id=CVE-2024-0015
16 Feb 2024 — In convertToComponentName of DreamService.java, there is a possible way to launch arbitrary protected activities due to intent redirection. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. En convertToComponentName de DreamService.java, existe una forma posible de iniciar actividades protegidas arbitrarias debido a la redirección de intención. Esto podría conducir a una escalada local de privilegios con permisos de ejecu... • https://github.com/UmVfX1BvaW50/CVE-2024-0015 • CWE-280: Improper Handling of Insufficient Permissions or Privileges •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-40085
https://notcve.org/view.php?id=CVE-2023-40085
16 Feb 2024 — In convertSubgraphFromHAL of ShimConverter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. En convertSubgraphFromHAL de ShimConverter.cpp, existe una posible lectura fuera de los límites debido a una verificación de los límites faltantes. Esto podría dar lugar a la divulgación de información local sin necesidad de privilegios de ejecución... • https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/ed6ee1f7eca7b33160e36ac6d730a9ef395ca4f1 • CWE-125: Out-of-bounds Read •
CVSS: 8.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-0041
https://notcve.org/view.php?id=CVE-2024-0041
16 Feb 2024 — In removePersistentDot of SystemStatusAnimationSchedulerImpl.kt, there is a possible race condition due to a logic error in the code. This could lead to local escalation of privilege that fails to remove the persistent dot with no additional execution privileges needed. User interaction is not needed for exploitation. En removePersistentDot de SystemStatusAnimationSchedulerImpl.kt, existe una posible condición de ejecución debido a un error lógico en el código. Esto podría provocar una escalada local de pri... • https://android.googlesource.com/platform/frameworks/base/+/d6f7188773409c8f5ad5fc7d3eea5b1751439e26 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 7.5EPSS: 18%CPEs: 5EXPL: 2CVE-2024-0040
https://notcve.org/view.php?id=CVE-2024-0040
16 Feb 2024 — In setParameter of MtpPacket.cpp, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. En setParameter de MtpPacket.cpp, existe una posible lectura fuera de los límites debido a un desbordamiento de búfer de almacenamiento dinámico. Esto podría conducir a la divulgación remota de información sin necesidad de privilegios de ejecución adicionales. • https://github.com/nidhihcl75/frameworks_av_AOSP10_r33_CVE-2024-0040 • CWE-122: Heap-based Buffer Overflow •
CVSS: 8.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-0038
https://notcve.org/view.php?id=CVE-2024-0038
16 Feb 2024 — In injectInputEventToInputFilter of AccessibilityManagerService.java, there is a possible arbitrary input event injection due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. En injectInputEventToInputFilter de AccessibilityManagerService.java, existe una posible inyección de evento de entrada arbitraria debido a una falta de verificación de permiso. Esto podría conducir a una esca... • https://android.googlesource.com/platform/frameworks/base/+/3e88d987235f5a2acd50a9b6bad78dbbf39cb079 • CWE-862: Missing Authorization •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2024-0037
https://notcve.org/view.php?id=CVE-2024-0037
16 Feb 2024 — In applyCustomDescription of SaveUi.java, there is a possible way to view images belonging to a different user due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation. En applyCustomDescription de SaveUi.java, existe una forma posible de ver imágenes que pertenecen a un usuario diferente debido a que falta una verificación de permiso. Esto podría dar lugar a la divulgación de información local c... • https://android.googlesource.com/platform/frameworks/base/+/55fc00a0788ea0995fe0851616b9ac21710a2931 • CWE-862: Missing Authorization CWE-922: Insecure Storage of Sensitive Information •
CVSS: 7.4EPSS: 0%CPEs: 5EXPL: 0CVE-2024-0036
https://notcve.org/view.php?id=CVE-2024-0036
16 Feb 2024 — In startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible way to bypass the restrictions on starting activities from the background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. En startNextMatchingActivity de ActivityTaskManagerService.java, existe una forma posible de evitar las restricciones para iniciar actividades desde segundo plano debido a u... • https://android.googlesource.com/platform/frameworks/base/+/3eaaa9687e90c65f51762deb343f18bef95d4e8e • CWE-284: Improper Access Control •
CVSS: 7.4EPSS: 0%CPEs: 5EXPL: 0CVE-2024-0035
https://notcve.org/view.php?id=CVE-2024-0035
16 Feb 2024 — In onNullBinding of TileLifecycleManager.java, there is a possible way to launch an activity from the background due to a missing null check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. En onNullBinding de TileLifecycleManager.java, existe una forma posible de iniciar una actividad desde segundo plano debido a que falta una verificación nula. Esto podría conducir a una escalada local de privilegios sin nece... • https://android.googlesource.com/platform/frameworks/base/+/7b7fff1eb5014d12200a32ff9047da396c7ab6a4 • CWE-476: NULL Pointer Dereference •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2024-0034
https://notcve.org/view.php?id=CVE-2024-0034
16 Feb 2024 — In BackgroundLaunchProcessController, there is a possible way to launch arbitrary activity from the background due to BAL Bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. En BackgroundLaunchProcessController, existe una forma posible de iniciar actividad arbitraria desde segundo plano debido a BAL Bypass. Esto podría conducir a una escalada local de privilegios sin necesidad de permisos de ejecución adic... • https://android.googlesource.com/platform/frameworks/base/+/653f7b0d234693309dc86161af01831b64033fe6 • CWE-276: Incorrect Default Permissions •