CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2023-44124 – Screen recording - Theft of arbitrary files with system privilege
https://notcve.org/view.php?id=CVE-2023-44124
The vulnerability is to theft of arbitrary files with system privilege in the Screen recording ("com.lge.gametools.gamerecorder") app in the "com/lge/gametools/gamerecorder/settings/ProfilePreferenceFragment.java" file. The main problem is that the app launches implicit intents that can be intercepted by third-party apps installed on the same device. They also can return arbitrary data that will be passed to the "onActivityResult()" method. The Screen recording app saves contents of arbitrary URIs to SD card which is a world-readable storage. La vulnerabilidad es el robo de archivos arbitrarios con privilegios del sistema en la aplicación de grabación de pantalla ("com.lge.gametools.gamerecorder") en el archivo "com/lge/gametools/gamerecorder/settings/ProfilePreferenceFragment.java". • https://lgsecurity.lge.com/bulletins/mobile#updateDetails • CWE-668: Exposure of Resource to Wrong Sphere CWE-927: Use of Implicit Intent for Sensitive Communication •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2023-44123 – Bluetooth - Theft and (over-)write of arbitrary files with system privilege via PendingIntent hijacking
https://notcve.org/view.php?id=CVE-2023-44123
The vulnerability is the use of implicit PendingIntents with the PendingIntent.FLAG_MUTABLE set that leads to theft and/or (over-)write of arbitrary files with system privilege in the Bluetooth ("com.lge.bluetoothsetting") app. The attacker's app, if it had access to app notifications, could intercept them and redirect them to its activity, before making it grant access permissions to content providers with the `android:grantUriPermissions="true"` flag. La vulnerabilidad es el uso de PendingIntents implícitos con el conjunto PendingIntent.FLAG_MUTABLE que conduce al robo y/o (sobre)escritura de archivos arbitrarios con privilegios del sistema en la aplicación Bluetooth ("com.lge.bluetoothsetting"). La aplicación del atacante, si tuviera acceso a las notificaciones de la aplicación, podría interceptarlas y redirigirlas a su actividad, antes de otorgar permisos de acceso a los proveedores de contenido con el indicador `android:grantUriPermissions="true"`. • https://lgsecurity.lge.com/bulletins/mobile#updateDetails • CWE-285: Improper Authorization •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2023-44122 – LockScreenSettings - Theft arbitrary files with system privilege
https://notcve.org/view.php?id=CVE-2023-44122
The vulnerability is to theft of arbitrary files with system privilege in the LockScreenSettings ("com.lge.lockscreensettings") app in the "com/lge/lockscreensettings/dynamicwallpaper/MyCategoryGuideActivity.java" file. The main problem is that the app launches implicit intents that can be intercepted by third-party apps installed on the same device. They also can return arbitrary data that will be passed to the "onActivityResult()" method. The LockScreenSettings app copies the received file to the "/data/shared/dw/mycategory/wallpaper_01.png" path and then changes the file access mode to world-readable and world-writable. La vulnerabilidad es el robo de archivos arbitrarios con privilegios del sistema en la aplicación LockScreenSettings ("com.lge.lockscreensettings") en el archivo "com/lge/lockscreensettings/dynamicwallpaper/MyCategoryGuideActivity.java". • https://lgsecurity.lge.com/bulletins/mobile#updateDetails • CWE-668: Exposure of Resource to Wrong Sphere CWE-927: Use of Implicit Intent for Sensitive Communication •
CVSS: 6.3EPSS: 0%CPEs: 2EXPL: 0CVE-2023-44121 – LG ThinQ Service - Intent redirection with system privilege/LaunchAnyWhere
https://notcve.org/view.php?id=CVE-2023-44121
The vulnerability is an intent redirection in LG ThinQ Service ("com.lge.lms2") in the "com/lge/lms/things/ui/notification/NotificationManager.java" file. This vulnerability could be exploited by a third-party app installed on an LG device by sending a broadcast with the action "com.lge.lms.things.notification.ACTION". Additionally, this vulnerability is very dangerous because LG ThinQ Service is a system app (having android:sharedUserId="android.uid.system" setting). Intent redirection in this app leads to accessing arbitrary not exported activities of absolutely all apps. La vulnerabilidad es una redirección de intención en LG ThinQ Service ("com.lge.lms2") en el archivo "com/lge/lms/things/ui/notification/NotificationManager.java". • https://lgsecurity.lge.com/bulletins/mobile#updateDetails • CWE-926: Improper Export of Android Application Components •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2023-35687
https://notcve.org/view.php?id=CVE-2023-35687
In MtpPropertyValue of MtpProperty.h, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. En MtpPropertyValue de MtpProperty.h, existe una posible corrupción de memoria debido a Use After Free. Esto podría conducir a una escalada local de privilegios sin necesidad de privilegios de ejecución adicionales. • https://android.googlesource.com/platform/frameworks/av/+/ea6131efa76a0b2a12724ffd157909e2c6fb4036 https://source.android.com/security/bulletin/2023-09-01 • CWE-416: Use After Free •