A week in security (April 1 – April 7)

A list of topics we covered in the week of April 1 to April 7 of 2024 Last week on Malwarebytes Labs: 60% of small businesses are concerned about cybersecurity threats Cookie consent choices are just being ignored by some websites Bing ad for NordVPN leads to SecTopRAT Jackson County hit by...

PT-2024-14707 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android affected versions not specified Description: The issue concerns a vulnerability in the ActivityManagerService AMS module related to starting activities in the background. Successful exploitation of this vulnerability will affect...

Google Pixel 安全漏洞

Google Android is a free and open source mobile operating system developed by Google Inc. based on the Linux kernel. Google Android suffers from an out-of-bounds read vulnerability that stems from a lack of bounds checking in the applyminlockconstraint module of the dvfs.c file. An attacker can...

Google Pixel 安全漏洞

Google Android is a free and open source mobile operating system developed by Google Inc. based on the Linux kernel. Google Android suffers from an elevation of privilege vulnerability that stems from the presence of debugging certificates that are whitelisted, no details of the vulnerability are...

PT-2024-22995 · Google · Android

Name of the Vulnerable Software and Affected Versions: Software affected versions not specified Description: The issue is related to a possible out of bounds read in the tmu get pi function of tmu.c due to improper input validation. This could lead to local information disclosure with no addition...

PT-2024-22986 · Google · Android

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is related to a possible out of bounds write in the lpm req handler function of lpm.c due to improper input validation. This could lead to loc...

Google Pixel 安全漏洞

Google Android is a free and open source mobile operating system developed by Google Inc. based on the Linux kernel. Google Android suffers from an out-of-bounds read vulnerability that originates from a missing boundary check in the tmugettemplut module of the tmu.c file, which can be exploited ...

PT-2024-22990 · Google · Android

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is related to a missing bounds check in the km exp did inner function of kmv.c, which could lead to a possible out of bounds read. This might...

PT-2024-22994 · Google · Android

Name of the Vulnerable Software and Affected Versions: Software affected versions not specified Description: The issue is related to a missing bounds check in TMU IPC GET TABLE, which could lead to a possible out of bounds read. This may result in local information disclosure without requiring...

PT-2024-22635 · Yahoo · Yahoo! Japan App For Android +1

Name of the Vulnerable Software and Affected Versions: Yahoo! JAPAN App for Android versions 2.3.1 through 3.161.1 Yahoo! JAPAN App for iOS versions 3.2.2 through 4.109.0 Description: The issue is related to a cross-site scripting vulnerability. If exploited, an arbitrary script may be executed o...

PT-2024-22554 · Unknown · Abema App For Android

Name of the Vulnerable Software and Affected Versions: ABEMA App for Android versions prior to 10.65.0 Description: The issue exists due to the improper export of Android application components, allowing another app installed on the user's device to access an arbitrary URL on the ABEMA App for...

Google Android Information Disclosure Vulnerability (CNVD-2024-24426)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an information disclosure vulnerability that stems from improper input validation in the smpprocsecreq method of the smpact.cc file, which may result in an out-of-bounds read. An attacker can...

Google Android elevation of privilege vulnerability (CNVD-2024-24428)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability due to a logic error in the code in installExistingPackageAsUser of InstallPackageHelper.java, which can be exploited by an attacker to escalate privileges...

Google Android Denial of Service Vulnerability (CNVD-2024-24425)

Google Android is a Linux-based open source operating system from Google. A denial of service vulnerability exists in Google Android, which stems from a logic error in the code of the writeUserLP method of the UserManagerService.java file, where a device policy is serialized with an incorrect tag...

Google Android elevation of privilege vulnerability (CNVD-2024-24427)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability caused by an out-of-bounds write to onQueueFilled in SoftMPEG4.cpp. An attacker can exploit this vulnerability to escalate privileges...

The vulnerability of the onNullBinding function in the TileLifecycleManager.java file of the Android operating system allows a hacker to escalate their privileges.

The vulnerability of the onNullBinding function in the TileLifecycleManager.java file of the Android operating system exists due to insufficient validation of input data. Exploiting this vulnerability can allow attackers to gain increased privileges...

Information disclosure

Outlook for Android Information Disclosure Vulnerability...

Microsoft Teams Security Vulnerability

Microsoft Teams is a software from Microsoft USA for online meetings, chat, and cloud storage features. A security vulnerability exists in Microsoft Teams for Android. An attacker exploiting the vulnerability could gain access to sensitive information...

PT-2024-21746 · Google · Android

Name of the Vulnerable Software and Affected Versions: TBD affected versions not specified Description: The issue is related to a possible out of bounds write due to a missing bounds check in the init data function. This could lead to local escalation of privilege with no additional execution...

PT-2024-21268 · Google · Android

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: In the tmu tz control function of tmu.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of...