SB2023041207 - Multiple vulnerabilities in Unisoc chipsets

Security Bulletin ID SB2023041207

Severity

Low

Patch available

YES

Number of vulnerabilities 11

Exploitation vector Local access

Highest impact Code execution

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 11 secuirty vulnerabilities.

1) Buffer overflow (CVE-ID: CVE-2022-47335)

The vulnerability allows a local privileged application to execute arbitrary code.

The vulnerability exists due to a missing permission check within the Telecom service in Android. A local privileged application can execute arbitrary code.

2) Buffer overflow (CVE-ID: CVE-2022-47336)

The vulnerability allows a local privileged application to execute arbitrary code.

The vulnerability exists due to a missing permission check within the Telecom service in Android. A local privileged application can execute arbitrary code.

3) Out-of-bounds write (CVE-ID: CVE-2022-47337)

The vulnerability allows a local application to read and manipulate data.

The vulnerability exists due to a missing permission check within the Media service in Android. A local application can read and manipulate data.

4) Information exposure (CVE-ID: CVE-2022-47338)

The vulnerability allows a local application to read and manipulate data.

The vulnerability exists due to a missing permission check within the email service in Android. A local application can read and manipulate data.

5) Buffer overflow (CVE-ID: CVE-2022-47362)

The vulnerability allows a local privileged application to read and manipulate data.

The vulnerability exists due to a missing permission check within the Telecom service in Android. A local privileged application can read and manipulate data.

6) Buffer overflow (CVE-ID: CVE-2022-47463)