Lucene search

[email protected]CVE-2022-20092

HistoryMay 03, 2022 - 8:15 p.m.

CVE-2022-20092

2022-05-0320:15:08

CWE-125

[email protected]

web.nvd.nist.gov

alac decoder

out of bounds read

local information disclosure

security vulnerability

nvd

cve-2022-20092

2.1 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

In alac decoder, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06366061; Issue ID: ALPS06366061.

Affected configurations

Vulners

NVD

Node

googleandroidRange<11.0

googleandroidRange<12.0

mediatekmt6761

mediatekmt6768

mediatekmt6779

mediatekmt6785

mediatekmt6833

mediatekmt6853

mediatekmt6853t

mediatekmt6873

mediatekmt6877

mediatekmt6879

mediatekmt6883

mediatekmt6885

mediatekmt6889

mediatekmt6893

mediatekmt6895

mediatekmt6983

mediatekmt8173

mediatekmt8175

mediatekmt8183

mediatekmt8185

mediatekmt8385

mediatekmt8791

mediatekmt8797

VendorProductVersionCPE
googleandroid*cpe:2.3:o:google:android:*:*:*:*:*:*:*:*
googleandroid*cpe:2.3:o:google:android:*:*:*:*:*:*:*:*
mediatekmt6761*cpe:2.3:h:mediatek:mt6761:*:*:*:*:*:*:*:*
mediatekmt6768*cpe:2.3:h:mediatek:mt6768:*:*:*:*:*:*:*:*
mediatekmt6779*cpe:2.3:h:mediatek:mt6779:*:*:*:*:*:*:*:*
mediatekmt6785*cpe:2.3:h:mediatek:mt6785:*:*:*:*:*:*:*:*
mediatekmt6833*cpe:2.3:h:mediatek:mt6833:*:*:*:*:*:*:*:*
mediatekmt6853*cpe:2.3:h:mediatek:mt6853:*:*:*:*:*:*:*:*
mediatekmt6853t*cpe:2.3:h:mediatek:mt6853t:*:*:*:*:*:*:*:*
mediatekmt6873*cpe:2.3:h:mediatek:mt6873:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
google	android	*	cpe:2.3:o:google:android::::::::
google	android	*	cpe:2.3:o:google:android::::::::
mediatek	mt6761	*	cpe:2.3:h:mediatek:mt6761::::::::
mediatek	mt6768	*	cpe:2.3:h:mediatek:mt6768::::::::
mediatek	mt6779	*	cpe:2.3:h:mediatek:mt6779::::::::
mediatek	mt6785	*	cpe:2.3:h:mediatek:mt6785::::::::
mediatek	mt6833	*	cpe:2.3:h:mediatek:mt6833::::::::
mediatek	mt6853	*	cpe:2.3:h:mediatek:mt6853::::::::
mediatek	mt6853t	*	cpe:2.3:h:mediatek:mt6853t::::::::
mediatek	mt6873	*	cpe:2.3:h:mediatek:mt6873::::::::

Rows per page:

1-10 of 251

CNA Affected

[
  {
    "product": "MT6761, MT6768, MT6779, MT6785, MT6833, MT6853, MT6853T, MT6873, MT6877, MT6879, MT6883, MT6885, MT6889, MT6893, MT6895, MT6983, MT8173, MT8175, MT8183, MT8185, MT8385, MT8791, MT8797",
    "vendor": "MediaTek, Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "Android 11.0, 12.0"
      }
    ]
  }
]

References

corp.mediatek.com/product-security-bulletin/May-2022

Social References

2.1 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

Related for CVE-2022-20092

prion1 nvd1 cvelist1