SB2023041207 - Multiple vulnerabilities in Unisoc chipsets

Security Bulletin ID SB2023041207

CSH Severity

Low

Patch available

YES

Number of vulnerabilities 11

Exploitation vector Local access

Highest impact Code execution

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 11 vulnerabilities.

1) Buffer overflow (CVE-ID: CVE-2022-47335)

CWE-ID: CWE-120 - Buffer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local privileged application to execute arbitrary code.

The vulnerability exists due to a missing permission check within the Telecom service in Android. A local privileged application can execute arbitrary code.

2) Buffer overflow (CVE-ID: CVE-2022-47336)

CWE-ID: CWE-120 - Buffer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local privileged application to execute arbitrary code.

The vulnerability exists due to a missing permission check within the Telecom service in Android. A local privileged application can execute arbitrary code.

3) Out-of-bounds write (CVE-ID: CVE-2022-47337)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local application to read and manipulate data.

The vulnerability exists due to a missing permission check within the Media service in Android. A local application can read and manipulate data.

4) Information exposure (CVE-ID: CVE-2022-47338)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local application to read and manipulate data.

The vulnerability exists due to a missing permission check within the email service in Android. A local application can read and manipulate data.

5) Buffer overflow (CVE-ID: CVE-2022-47362)

CWE-ID: CWE-120 - Buffer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local privileged application to read and manipulate data.

The vulnerability exists due to a missing permission check within the Telecom service in Android. A local privileged application can read and manipulate data.

6) Buffer overflow (CVE-ID: CVE-2022-47463)

CWE-ID: CWE-120 - Buffer overflow