CVE-2022-20496

🗓️ 13 Dec 2022 00:00:00Reported by google_androidType

In setDataSource of initMediaExtractor.cpp, there is a possibility of arbitrary code execution due to a use after free. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-12 Android-12L Android-1

Reporter	Title	Published	Views	Family All 13
Android Security Bulletins	Android Security Bulletin—December 2022Stay organized with collectionsSave and categorize content based on your preferences.	5 Dec 202200:00	–	androidsecurity
Circl	CVE-2022-20496	13 Dec 202218:21	–	circl
CNNVD	Google Pixel 资源管理错误漏洞	5 Dec 202200:00	–	cnnvd
CVE	CVE-2022-20496	13 Dec 202200:00	–	cve
EUVD	EUVD-2022-25756	3 Oct 202520:07	–	euvd
NCSC	Vulnerabilities fixed in Google Android and Samsung Mobile	6 Dec 202200:00	–	ncsc
NVD	CVE-2022-20496	13 Dec 202216:15	–	nvd
OSV	ASB-A-245242273	1 Dec 202200:00	–	osv
OSV	CVE-2022-20496	13 Dec 202216:15	–	osv
Prion	Design/Logic Flaw	13 Dec 202216:15	–	prion

[
  {
    "vendor": "n/a",
    "product": "Android",
    "versions": [
      {
        "version": "Android-12 Android-12L Android-13",
        "status": "affected"
      }
    ]
  }
]

Source	Link
source	www.source.android.com/security/bulletin/2022-12-01

13 Dec 2022 00:00Current

6Medium risk

Vulners AI Score6

EPSS0.0013