SB2023120418 - Multiple vulnerabilities in Unisoc chipsets
Published: December 4, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 90 vulnerabilities.
1) Missing Authorization (CVE-ID: CVE-2023-42692)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a possible missing permission check within the wifi service in Android. A local application can gain access to sensitive information.
2) Missing Authorization (CVE-ID: CVE-2023-42693)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform service disruption.
The vulnerability exists due to a possible missing permission check within the wifi service in Android. A local application can perform service disruption.
3) Missing Authorization (CVE-ID: CVE-2023-42691)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a possible missing permission check within the wifi service in Android. A local application can gain access to sensitive information.
4) Information exposure (CVE-ID: CVE-2023-42672)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a possible way to write permission usage records of an app due to a missing permission check within the imsservice in Android. A local application can gain access to sensitive information.
5) Information exposure (CVE-ID: CVE-2023-42673)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a possible way to write permission usage records of an app due to a missing permission check within the imsservice in Android. A local application can gain access to sensitive information.
6) Information exposure (CVE-ID: CVE-2023-42674)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a possible way to write permission usage records of an app due to a missing permission check within the imsservice in Android. A local application can gain access to sensitive information.
7) Information exposure (CVE-ID: CVE-2023-42675)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a possible way to write permission usage records of an app due to a missing permission check within the imsservice in Android. A local application can gain access to sensitive information.
8) Information exposure (CVE-ID: CVE-2023-42676)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a possible way to write permission usage records of an app due to a missing permission check within the imsservice in Android. A local application can gain access to sensitive information.
9) Information exposure (CVE-ID: CVE-2023-42677)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a possible way to write permission usage records of an app due to a missing permission check within the imsservice in Android. A local application can gain access to sensitive information.
10) Information exposure (CVE-ID: CVE-2023-42678)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a possible way to write permission usage records of an app due to a missing permission check within the imsservice in Android. A local application can gain access to sensitive information.
11) Out-of-bounds write (CVE-ID: CVE-2023-42679)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged application to read and manipulate data.
The vulnerability exists due to a possible out of bounds write due to a missing bounds check within the gpu driver in Android. A local privileged application can read and manipulate data.
12) Out-of-bounds read (CVE-ID: CVE-2023-42680)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged application to damange or delete data.
The vulnerability exists due to a possible out of bounds read due to a missing bounds check within the gpu driver in Kernel. A local privileged application can damange or delete data.
13) Information exposure (CVE-ID: CVE-2023-42715)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a possible missing permission check within the telephony service in Android. A local application can gain access to sensitive information.
14) Missing Authorization (CVE-ID: CVE-2023-42681)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to manipulate or delete data.
The vulnerability exists due to a possible missing permission check within the ion service in Android. A local application can manipulate or delete data.
15) Out-of-bounds read (CVE-ID: CVE-2023-42683)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged application to damange or delete data.
The vulnerability exists due to a possible out of bounds read due to a missing bounds check within the gsp driver in Kernel. A local privileged application can damange or delete data.
16) Out-of-bounds read (CVE-ID: CVE-2023-42684)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged application to damange or delete data.
The vulnerability exists due to a possible out of bounds read due to a missing bounds check within the gsp driver in Kernel. A local privileged application can damange or delete data.
17) Missing Authorization (CVE-ID: CVE-2023-42685)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform service disruption.
The vulnerability exists due to a possible missing permission check within the wifi service in Android. A local application can perform service disruption.
18) Missing Authorization (CVE-ID: CVE-2023-42686)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform service disruption.
The vulnerability exists due to a possible missing permission check within the wifi service in Android. A local application can perform service disruption.
19) Missing Authorization (CVE-ID: CVE-2023-42687)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a possible missing permission check within the wifi service in Android. A local application can gain access to sensitive information.
20) Missing Authorization (CVE-ID: CVE-2023-42688)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform service disruption.
The vulnerability exists due to a possible missing permission check within the wifi service in Android. A local application can perform service disruption.
21) Missing Authorization (CVE-ID: CVE-2023-42689)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform service disruption.
The vulnerability exists due to a possible missing permission check within the wifi service in Android. A local application can perform service disruption.
22) Missing Authorization (CVE-ID: CVE-2023-42690)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform service disruption.
The vulnerability exists due to a possible missing permission check within the wifi service in Android. A local application can perform service disruption.
23) Buffer overflow (CVE-ID: CVE-2023-42682)
CWE-ID: CWE-120 - Buffer overflow
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged application to damange or delete data.
The vulnerability exists due to a possible out of bounds write due to a missing bounds check within the gsp driver in Kernel. A local privileged application can damange or delete data.
24) Information exposure (CVE-ID: CVE-2023-42704)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a possible way to write permission usage records of an app due to a missing permission check within the imsservice in Android. A local application can gain access to sensitive information.
25) Missing Authorization (CVE-ID: CVE-2023-42695)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a possible missing permission check within the wifi service in Android. A local application can gain access to sensitive information.
26) Missing Authorization (CVE-ID: CVE-2023-42696)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to crash the entire system.
The vulnerability exists due to a possible missing permission check within the telecom service in Android. A remote attacker can trick the victim to open a specially crafted file and crash the entire system.
27) Information exposure (CVE-ID: CVE-2023-42697)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a possible way to write permission usage records of an app due to a missing permission check within the omacp service in Android. A local application can gain access to sensitive information.
28) Information exposure (CVE-ID: CVE-2023-42698)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a possible way to write permission usage records of an app due to a missing permission check within the omacp service in Android. A local application can gain access to sensitive information.
29) Information exposure (CVE-ID: CVE-2023-42699)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a possible way to write permission usage records of an app due to a missing permission check within the omacp service in Android. A local application can gain access to sensitive information.
30) Information exposure (CVE-ID: CVE-2023-42700)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a possible way to write permission usage records of an app due to a missing permission check within the firewall service in Android. A local application can gain access to sensitive information.
31) Information exposure (CVE-ID: CVE-2023-42701)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a possible way to write permission usage records of an app due to a missing permission check within the firewall service in Android. A local application can gain access to sensitive information.
32) Information exposure (CVE-ID: CVE-2023-42702)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a possible way to write permission usage records of an app due to a missing permission check within the firewall service in Android. A local application can gain access to sensitive information.
33) Information exposure (CVE-ID: CVE-2023-42703)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a possible way to write permission usage records of an app due to a missing permission check within the firewall service in Android. A local application can gain access to sensitive information.
34) Missing Authorization (CVE-ID: CVE-2023-42694)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to perform service disruption.
The vulnerability exists due to a possible missing permission check within the wifi service in Android. A local application can perform service disruption.
35) Information exposure (CVE-ID: CVE-2023-42671)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a possible way to write permission usage records of an app due to a missing permission check within the imsservice in Android. A local application can gain access to sensitive information.
36) Information exposure (CVE-ID: CVE-2023-42706)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a possible way to write permission usage records of an app due to a missing permission check within the firewall service in Android. A local application can gain access to sensitive information.
37) Information exposure (CVE-ID: CVE-2023-42707)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a possible way to write permission usage records of an app due to a missing permission check within the firewall service in Android. A local application can gain access to sensitive information.
38) Information exposure (CVE-ID: CVE-2023-42708)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a possible way to write permission usage records of an app due to a missing permission check within the firewall service in Android. A local application can gain access to sensitive information.
39) Information exposure (CVE-ID: CVE-2023-42709)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a possible way to write permission usage records of an app due to a missing permission check within the firewall service in Android. A local application can gain access to sensitive information.
40) Information exposure (CVE-ID: CVE-2023-42710)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a possible way to write permission usage records of an app due to a missing permission check within the firewall service in Android. A local application can gain access to sensitive information.
41) Information exposure (CVE-ID: CVE-2023-42711)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a possible way to write permission usage records of an app due to a missing permission check within the firewall service in Android. A local application can gain access to sensitive information.
42) Information exposure (CVE-ID: CVE-2023-42712)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a possible way to write permission usage records of an app due to a missing permission check within the firewall service in Android. A local application can gain access to sensitive information.
43) Information exposure (CVE-ID: CVE-2023-42713)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a possible way to write permission usage records of an app due to a missing permission check within the firewall service in Android. A local application can gain access to sensitive information.
44) Information exposure (CVE-ID: CVE-2023-42714)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a possible way to write permission usage records of an app due to a missing permission check within the firewall service in Android. A local application can gain access to sensitive information.
45) Information exposure (CVE-ID: CVE-2023-42705)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a possible way to write permission usage records of an app due to a missing permission check within the imsservice in Android. A local application can gain access to sensitive information.
46) Out-of-bounds write (CVE-ID: CVE-2023-42727)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged application to read and manipulate data.
The vulnerability exists due to a possible out of bounds write due to a incorrect bounds check within the gpu driver in Kernel. A local privileged application can read and manipulate data.
47) Information exposure (CVE-ID: CVE-2023-42717)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a possible missing permission check within the telephony service in Android. A local application can gain access to sensitive information.
48) Missing Authorization (CVE-ID: CVE-2023-42736)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to manipulate or delete data.
The vulnerability exists due to a possible missing permission check within the telecom service in Android. A local application can manipulate or delete data.
49) Information exposure (CVE-ID: CVE-2023-42734)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a possible missing permission check within the telephony service in Android. A local application can gain access to sensitive information.
50) Out-of-bounds read (CVE-ID: CVE-2023-42719)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to a possible out of bounds read due to a incorrect bounds check within the video service in Android. A remote attacker can gain access to sensitive information.
51) Out-of-bounds read (CVE-ID: CVE-2023-42720)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to a possible out of bounds read due to a missing bounds check within the video service in Android. A remote attacker can gain access to sensitive information.
52) Memory corruption (CVE-ID: CVE-2023-42721)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform service disruption.
The vulnerability exists due to a possible missing verification incorrect input within the flv extractor in Android. A remote attacker can perform service disruption.
53) Memory corruption (CVE-ID: CVE-2023-42722)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to manipulate data.
The vulnerability exists due to a possible use after free due to a logic error within the camera service in Android. A local application can manipulate data.
54) Out-of-bounds read (CVE-ID: CVE-2023-42723)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to manipulate data.
The vulnerability exists due to a possible out of bounds read due to a missing bounds check within the camera service in Android. A local application can manipulate data.
55) Out-of-bounds read (CVE-ID: CVE-2023-42724)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged application to read and manipulate data.
The vulnerability exists due to a possible out of bounds read due to a missing bounds check within the gpu driver in Kernel. A local privileged application can read and manipulate data.
56) Out-of-bounds read (CVE-ID: CVE-2023-42725)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged application to read and manipulate data.
The vulnerability exists due to a possible out of bounds read due to a missing bounds check within the gpu driver in Kernel. A local privileged application can read and manipulate data.
57) Out-of-bounds read (CVE-ID: CVE-2023-42726)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged application to read and manipulate data.
The vulnerability exists due to a possible out of bounds read due to a missing bounds check within the TeleService in Android. A local privileged application can read and manipulate data.
58) Missing Authorization (CVE-ID: CVE-2023-42748)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to manipulate or delete data.
The vulnerability exists due to a possible missing permission check within the telecom service in Android. A local application can manipulate or delete data.
59) Information exposure (CVE-ID: CVE-2023-42735)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a possible missing permission check within the telephony service in Android. A local application can gain access to sensitive information.
60) Out-of-bounds read (CVE-ID: CVE-2023-42728)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to manipulate or delete data.
The vulnerability exists due to a possible out of bounds read due to a missing bounds check within the phasecheckserver in Android. A local application can manipulate or delete data.
61) Information exposure (CVE-ID: CVE-2023-42730)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a possible way to write permission usage records of an app due to a missing permission check within the IMS service in Android. A local application can gain access to sensitive information.
62) Buffer overflow (CVE-ID: CVE-2023-42731)
CWE-ID: CWE-120 - Buffer overflow
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged application to read and manipulate data.
The vulnerability exists due to a possible out of bounds read due to a missing bounds check within the Gnss service in Android. A local privileged application can read and manipulate data.
63) Buffer overflow (CVE-ID: CVE-2023-42751)
CWE-ID: CWE-120 - Buffer overflow
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to read and manipulate data.
The vulnerability exists due to a possible out of bounds write due to a missing bounds check within the gnss service in WCN. A local application can read and manipulate data.
64) Buffer overflow (CVE-ID: CVE-2022-48462)
CWE-ID: CWE-120 - Buffer overflow
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged application to execute arbitrary code.
The vulnerability exists due to a possible out of bounds write due to a missing bounds check within the wifi service in Android. A local privileged application can execute arbitrary code.
65) Buffer overflow (CVE-ID: CVE-2022-48463)
CWE-ID: CWE-120 - Buffer overflow
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged application to execute arbitrary code.
The vulnerability exists due to a possible out of bounds write due to a missing bounds check within the wifi service in Android. A local privileged application can execute arbitrary code.
66) Buffer overflow (CVE-ID: CVE-2022-48464)
CWE-ID: CWE-120 - Buffer overflow
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged application to execute arbitrary code.
The vulnerability exists due to a possible out of bounds write due to a missing bounds check within the wifi service in Android. A local privileged application can execute arbitrary code.
67) Information exposure (CVE-ID: CVE-2023-42732)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a possible missing permission check within the telephony service in Android. A local application can gain access to sensitive information.
68) Information exposure (CVE-ID: CVE-2023-42733)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a possible missing permission check within the telephony service in Android. A local application can gain access to sensitive information.
69) Missing Authorization (CVE-ID: CVE-2023-42746)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to manipulate or delete data.
The vulnerability exists due to a possible missing permission check within the power manager in Android. A local application can manipulate or delete data.
70) Information exposure (CVE-ID: CVE-2023-42716)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a possible missing permission check within the telephony service in Android. A local application can gain access to sensitive information.
71) Information exposure (CVE-ID: CVE-2023-42718)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a possible way to write permission usage records of an app due to a missing permission check within the dialer in Android. A local application can gain access to sensitive information.
72) Missing Authorization (CVE-ID: CVE-2023-42738)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to manipulate or delete data.
The vulnerability exists due to a possible missing permission check within the telocom service in Android. A local application can manipulate or delete data.
73) Information exposure (CVE-ID: CVE-2023-42739)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a possible way to write permission usage records of an app due to a missing permission check within the engineermode service in Android. A local application can gain access to sensitive information.
74) Missing Authorization (CVE-ID: CVE-2023-42740)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to manipulate or delete data.
The vulnerability exists due to a possible way to write permission usage records of an app due to a missing permission check within the telecom service in Android. A local application can manipulate or delete data.
75) Information exposure (CVE-ID: CVE-2023-42741)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a possible way to write permission usage records of an app due to a missing permission check within the telecom service in Android. A local application can gain access to sensitive information.
76) Missing Authorization (CVE-ID: CVE-2023-42742)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to manipulate or delete data.
The vulnerability exists due to a possible missing permission check within the sysui in Android. A local application can manipulate or delete data.
77) Missing Authorization (CVE-ID: CVE-2023-42743)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to manipulate or delete data.
The vulnerability exists due to a possible missing permission check within the telecom service in Android. A local application can manipulate or delete data.
78) Missing Authorization (CVE-ID: CVE-2023-42744)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to manipulate or delete data.
The vulnerability exists due to a possible missing permission check within the telecom service in Android. A local application can manipulate or delete data.
79) Missing Authorization (CVE-ID: CVE-2023-42745)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to manipulate or delete data.
The vulnerability exists due to a possible missing permission check within the telecom service in Android. A local application can manipulate or delete data.
80) Out-of-bounds write (CVE-ID: CVE-2023-42729)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged application to execute arbitrary code.
The vulnerability exists due to a possible out of bounds write due to a missing bounds check within the ril service in Android. A local privileged application can execute arbitrary code.
81) Information exposure (CVE-ID: CVE-2023-42737)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a possible way to write permission usage records of an app due to a missing permission check within the telecom service in Android. A local application can gain access to sensitive information.
82) Missing Authorization (CVE-ID: CVE-2023-42747)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local application to manipulate or delete data.
The vulnerability exists due to a possible missing permission check within the camera service in Android. A local application can manipulate or delete data.
83) Information exposure (CVE-ID: CVE-2023-42749)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a possible way to write permission usage records of an app due to a missing permission check within the enginnermode service in Android. A local application can gain access to sensitive information.
84) Buffer overflow (CVE-ID: CVE-2022-48454)
CWE-ID: CWE-120 - Buffer overflow
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to a possible out of bounds write due to a missing bounds check within the wifi service in Android. A local application can execute arbitrary code.
85) Buffer overflow (CVE-ID: CVE-2022-48455)
CWE-ID: CWE-120 - Buffer overflow
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to a possible out of bounds write due to a missing bounds check within the wifi service in Android. A local application can execute arbitrary code.
86) Memory corruption (CVE-ID: CVE-2022-48456)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to a possible out of bounds write due to a incorrect bounds check within the camera driver in Kernel. A local application can execute arbitrary code.
87) Incorrect Permission Assignment for Critical Resource (CVE-ID: CVE-2022-48457)
CWE-ID: CWE-732 - Incorrect Permission Assignment for Critical Resource
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to crash the entire system.
The vulnerability exists due to a possible system crash due to improper input validation within the TeleService in Android. A local application can crash the entire system.
88) Incorrect Permission Assignment for Critical Resource (CVE-ID: CVE-2022-48458)
CWE-ID: CWE-732 - Incorrect Permission Assignment for Critical Resource
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to crash the entire system.
The vulnerability exists due to a possible system crash due to improper input validation within the TeleService in Android. A local application can crash the entire system.
89) Incorrect Permission Assignment for Critical Resource (CVE-ID: CVE-2022-48459)
CWE-ID: CWE-732 - Incorrect Permission Assignment for Critical Resource
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to crash the entire system.
The vulnerability exists due to a possible system crash due to improper input validation within the TeleService in Android. A local application can crash the entire system.
90) Stack-based buffer overflow (CVE-ID: CVE-2022-48461)
CWE-ID: CWE-121 - Stack-based buffer overflow
CVSSv4: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to a possible out of bounds write due to a missing bounds check within the sensor driver in Kernel. A local application can execute arbitrary code.
Remediation
Install update from vendor's website.