Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15,082 results · page 112 of 302
Nov 20, 2024In the deserialization constructor of NanoAppFilter.java, there is a possible loss of data due to type confusion.CVE-2018-9471 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In the deserialization constructor of NanoAppFilter.java, there is a possible loss of data due to type confusion. This could lead to local escalation of privilege in the system server with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2024In bff_Scanner_addOutPos of Scanner.c, there is a possible out-of-bounds write due to an incorrect bounds check.CVE-2018-9470 · Computers, phones & browsers · Google · reported by security@android.comHigh 8.8
In bff_Scanner_addOutPos of Scanner.c, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege in an unprivileged app with no additional execution privileges needed. User interaction is needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2024In multiple functions of ShortcutService.java, there is a possible creation of a spoofed shortcut due to a missing permission check.CVE-2018-9469 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In multiple functions of ShortcutService.java, there is a possible creation of a spoofed shortcut due to a missing permission check. This could lead to local escalation of privilege in a privileged app with no additional execution privileges needed. User interaction is needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2024In query of DownloadManager.java, there is a possible read/write of arbitrary files due to a permissions bypass.CVE-2018-9468 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.1
In query of DownloadManager.java, there is a possible read/write of arbitrary files due to a permissions bypass. This could lead to local information disclosure and file rewriting with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2024Contact Page With Google Map: Path Traversal: '.../...//'CVE-2024-52447 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Path Traversal: '.../...//' vulnerability in corporatezen222 Contact Page With Google Map contact-page-with-google-map allows Path Traversal.This issue affects Contact Page With Google Map: from n/a through <= 1.6.1.
- Product
- Contact Page With Google Map
- Affected
- up to 1.6.1
- What to do
- Affects up to 1.6.1. Update Contact Page With Google Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 20, 2024There exists a code execution vulnerability in the Car App Android Jetpack Library.CVE-2024-10382 · Computers, phones & browsers · Google · reported by cve-coordination@google.comHigh 7.3
There exists a code execution vulnerability in the Car App Android Jetpack Library. CarAppService uses deserialization logic that allows construction of arbitrary java classes. This can lead to arbitrary code execution when combined with specific Java deserialization gadgets. An attacker needs to install a malicious application on victims device to be able to attack any application that uses vulnerable library. We recommend upgrading the library past version 1.7.0-beta02.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024In the getHost() function of UriTest.java, there is the possibility of incorrect web origin determination.CVE-2018-9467 · Computers, phones & browsers · Google · reported by security@android.comCritical 9.8
In the getHost() function of UriTest.java, there is the possibility of incorrect web origin determination. This could lead to incorrect security decisions with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024In the xmlSnprintfElementContent function of valid.c, there is a possible out of bounds write.CVE-2018-9466 · Computers, phones & browsers · Google · reported by security@android.comHigh 8.8
In the xmlSnprintfElementContent function of valid.c, there is a possible out of bounds write. This could lead to remote escalation of privilege in an unprivileged app with no additional execution privileges needed. User interaction is needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsecurity.netapp.com
Nov 19, 2024In sdpu_extract_attr_seq of sdp_utils.cc, there is a possible out of bounds read due to an incorrect bounds check.CVE-2018-9456 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.5
In sdpu_extract_attr_seq of sdp_utils.cc, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024In parse of M3UParser.cpp there is a possible resource exhaustion due to improper input validation.CVE-2018-9440 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.5
In parse of M3UParser.cpp there is a possible resource exhaustion due to improper input validation. This could lead to denial of service with no additional execution privileges needed. User interaction is needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024In ArrayConcatVisitor of builtins-array.cc, there is a possible type confusion due to improper input validation.CVE-2018-9433 · Computers, phones & browsers · Google · reported by security@android.comHigh 8.8
In ArrayConcatVisitor of builtins-array.cc, there is a possible type confusion due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024In createPhonebookDialogView and createMapDialogView of BluetoothPermissionActivity.java, there is a possible permissions bypass.CVE-2018-9432 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In createPhonebookDialogView and createMapDialogView of BluetoothPermissionActivity.java, there is a possible permissions bypass. This could lead to local escalation of privilege due to hiding and bypassing the user's ability to disable access to contacts, with no additional execution privileges needed. User interaction is needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024In startDevice of AAudioServiceStreamBase.cpp there is a possible out of bounds write due to a use after free.CVE-2018-9428 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In startDevice of AAudioServiceStreamBase.cpp there is a possible out of bounds write due to a use after free. This could lead to local arbitrary code execution with no additional execution privileges needed. User interaction is needed for exploitation. https://source.android.com/security/bulletin/2018-07-01
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024In CryptoPlugin::decrypt of CryptoPlugin.cpp, there is a possible out of bounds write due to a missing bounds check.CVE-2018-9424 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In CryptoPlugin::decrypt of CryptoPlugin.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024In writeInplace of Parcel.cpp, there is a possible information leak across processes, using Binder, due to uninitialized data.CVE-2018-9421 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In writeInplace of Parcel.cpp, there is a possible information leak across processes, using Binder, due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024In BnCameraService::onTransact of CameraService.cpp, there is a possible information disclosure due to uninitialized data.CVE-2018-9420 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In BnCameraService::onTransact of CameraService.cpp, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024In l2cble_process_sig_cmd of l2c_ble.cc, there is a possible out of bounds read due to a missing bounds check.CVE-2018-9419 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.5
In l2cble_process_sig_cmd of l2c_ble.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024In f_hidg_read and hidg_disable of f_hid.c, there is a possible use-after-free due to improper locking.CVE-2018-9417 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In f_hidg_read and hidg_disable of f_hid.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024In removeUnsynchronization of ID3.cpp there is a possible resource exhaustion due to improper input validation.CVE-2018-9412 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In removeUnsynchronization of ID3.cpp there is a possible resource exhaustion due to improper input validation. This could lead to denial of service with no additional execution privileges needed. User interaction is needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024In decrypt of ClearKeyCasPlugin.cpp there is a possible out-of-bounds write due to a missing bounds check.CVE-2018-9411 · Computers, phones & browsers · Google · reported by security@android.comHigh 8.8
In decrypt of ClearKeyCasPlugin.cpp there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote arbitrary code execution with no additional execution privileges needed. User interaction is needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024In analyzeAxes of FontUtils.cpp, there is a possible out of bounds read due to a missing bounds check.CVE-2018-9410 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In analyzeAxes of FontUtils.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024In smp_data_received of smp_l2c.cc, there is a possible out of bounds read followed by code execution due to a missing bounds check.CVE-2018-9365 · Computers, phones & browsers · Google · reported by security@android.comHigh 8.8
In smp_data_received of smp_l2c.cc, there is a possible out of bounds read followed by code execution due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.
- Product
- Andrioid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024Type Confusion in V8 in Google Chrome prior to 131.0.6778.85 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.CVE-2024-11395 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Type Confusion in V8 in Google Chrome prior to 131.0.6778.85 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Nov 19, 2024In HWCSession::SetColorModeById of hwc_session.cpp, there is a possible out of bounds write due to a missing bounds check.CVE-2018-9409 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In HWCSession::SetColorModeById of hwc_session.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024In cmd_flash_mmc_sparse_img of dl_commands.c, there is a possible out of bounds write due to a missing bounds check.CVE-2018-9372 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In cmd_flash_mmc_sparse_img of dl_commands.c, there is a possible out of bounds write due to a missing bounds check. This could lead to a local escalation of privilege in the bootloader with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024In the Mediatek Preloader, there are out of bounds reads and writes due to an exposed interface that allows arbitrary peripheral memory mapping with insufficienCVE-2018-9371 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.4
In the Mediatek Preloader, there are out of bounds reads and writes due to an exposed interface that allows arbitrary peripheral memory mapping with insufficient blacklisting/whitelisting. This could lead to local elevation of privilege, given physical access to the device with no additional execution privileges needed. User interaction is needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024In download.c there is a special mode allowing user to download data into memory and causing possible memory corruptions due to missing bounds check.CVE-2018-9370 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.3
In download.c there is a special mode allowing user to download data into memory and causing possible memory corruptions due to missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024In bootloader there is fastboot command allowing user specified kernel command line arguments.CVE-2018-9369 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.3
In bootloader there is fastboot command allowing user specified kernel command line arguments. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024In mtkscoaudio debugfs there is a possible arbitrary kernel memory write due to missing bounds check and weakened SELinux policies.CVE-2018-9368 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In mtkscoaudio debugfs there is a possible arbitrary kernel memory write due to missing bounds check and weakened SELinux policies. This could lead to local escalation of privilege with system execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024In FT_ACDK_CCT_V2_OP_ISP_SET_TUNING_PARAS of Meta_CCAP_Para.cpp, there is a possible out of bounds write due to improper input validation.CVE-2018-9367 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In FT_ACDK_CCT_V2_OP_ISP_SET_TUNING_PARAS of Meta_CCAP_Para.cpp, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024In IMSA_Recv_Thread and VT_IMCB_Thread of ImsaClient.cpp and VideoTelephony.c, there is a possible out of bounds write due to an integer overflow.CVE-2018-9366 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In IMSA_Recv_Thread and VT_IMCB_Thread of ImsaClient.cpp and VideoTelephony.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024In the LG LAF component, there is a special command that allowed modification of certain partitions.CVE-2018-9364 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.5
In the LG LAF component, there is a special command that allowed modification of certain partitions. This could lead to bypass of secure boot. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024In SMF_ParseMetaEvent of eas_smf.c, there is a possible integer overflow.CVE-2018-9348 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.5
In SMF_ParseMetaEvent of eas_smf.c, there is a possible integer overflow. This could lead to remote denial of service due to resource exhaustion with no additional execution privileges needed. User interaction is needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024In BnAudioPolicyService::onTransact of AudioPolicyService.cpp, there is a possible information disclosure due to uninitialized data.CVE-2018-9346 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In BnAudioPolicyService::onTransact of AudioPolicyService.cpp, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024In BnAudioPolicyService::onTransact of AudioPolicyService.cpp, there is a possible information disclosure due to uninitialized data.CVE-2018-9345 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In BnAudioPolicyService::onTransact of AudioPolicyService.cpp, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024In several functions of DescramblerImpl.cpp, there is a possible use after free due to improper locking.CVE-2018-9344 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In several functions of DescramblerImpl.cpp, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024In impeg2d_mc_fullx_fully of impeg2d_mc.c there is a possible out of bound write due to missing bounds check.CVE-2018-9341 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In impeg2d_mc_fullx_fully of impeg2d_mc.c there is a possible out of bound write due to missing bounds check. This could lead to remote arbitrary code execution with no additional execution privileges needed. User interaction is needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024In ResStringPool::setTo of ResourceTypes.cpp, it's possible for an attacker to control the value of mStringPoolSize to be out of bounds, causing information disCVE-2018-9340 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In ResStringPool::setTo of ResourceTypes.cpp, it's possible for an attacker to control the value of mStringPoolSize to be out of bounds, causing information disclosure.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024In writeTypedArrayList and readTypedArrayList of Parcel.java, there is a possible escalation of privilege due to type confusion.CVE-2018-9339 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In writeTypedArrayList and readTypedArrayList of Parcel.java, there is a possible escalation of privilege due to type confusion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024In restorePermissionState of PermissionManagerServiceImpl.java, there is a possible way for an app to keep permissions that should be revoked due to incorrect pCVE-2023-21270 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In restorePermissionState of PermissionManagerServiceImpl.java, there is a possible way for an app to keep permissions that should be revoked due to incorrect permission flags cleared during an update. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.
- Product
- Andrioid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024In ResStringPool::setTo of ResourceTypes.cpp, there is a possible out of bounds write due to a missing bounds check.CVE-2018-9338 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In ResStringPool::setTo of ResourceTypes.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024In writeToParcel and createFromParcel of DcParamObject.java, there is a permission bypass due to a write size mismatch.CVE-2017-13315 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In writeToParcel and createFromParcel of DcParamObject.java, there is a permission bypass due to a write size mismatch. This could lead to an elevation of privileges where the user can start an activity with system privileges, with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024Google Visualization Charts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51862 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Baptiste Wicht Google Visualization Charts google-visualization-charts allows Stored XSS.This issue affects Google Visualization Charts: from n/a through <= 0.1.
- Product
- Google Visualization Charts
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update Google Visualization Charts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024Google for WooCommerce: Information DisclosureCVE-2024-10486 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Google for WooCommerce plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 2.8.6. This is due to publicly accessible print_php_information.php file. This makes it possible for unauthenticated attackers to retrieve information about Webserver and PHP configuration, which can be used to aid other attacks.
- Product
- Google for WooCommerce
- Affected
- up to 2.8.6
- What to do
- Affects up to 2.8.6. Update Google for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 15, 2024In setAllowOnlyVpnForUids of NetworkManagementService.java, there is a possible security settings bypass due to a missing permission check.CVE-2017-13314 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In setAllowOnlyVpnForUids of NetworkManagementService.java, there is a possible security settings bypass due to a missing permission check. This could lead to local escalation of privilege allowing users to access non-VPN networks, when they are supposed to be restricted to the VPN networks, with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024In ElementaryStreamQueue::dequeueAccessUnitMPEG4Video of ESQueue.cpp, there is a possible infinite loop leading to resource exhaustion due to an incorrect boundCVE-2017-13313 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.5
In ElementaryStreamQueue::dequeueAccessUnitMPEG4Video of ESQueue.cpp, there is a possible infinite loop leading to resource exhaustion due to an incorrect bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024In createFromParcel of MediaCas.java, there is a possible parcel read/write mismatch due to improper input validation.CVE-2017-13312 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In createFromParcel of MediaCas.java, there is a possible parcel read/write mismatch due to improper input validation. This could lead to local escalation of privilege where an app can start an activity with system privileges with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024In the read() function of ProcessStats.java, there is a possible read/write serialization issue leading to a permissions bypass.CVE-2017-13311 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.7
In the read() function of ProcessStats.java, there is a possible read/write serialization issue leading to a permissions bypass. This could lead to local escalation of privilege where an app can start an activity with system privileges with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024In createFromParcel of ViewPager.java, there is a possible read/write serialization issue leading to a permissions bypass.CVE-2017-13310 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In createFromParcel of ViewPager.java, there is a possible read/write serialization issue leading to a permissions bypass. This could lead to local escalation of privilege where an app can start an activity with system privileges with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024In readEncryptedData of ConscryptEngine.java, there is a possible plaintext leak due to improperly used crypto.CVE-2017-13309 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In readEncryptedData of ConscryptEngine.java, there is a possible plaintext leak due to improperly used crypto. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.