CVE-2024-10382 Arbitrary Code execution in Car App Android Jetpack Library

There exists a code execution vulnerability in the Car App Android Jetpack Library. CarAppService uses deserialization logic that allows construction of arbitrary java classes. This can lead to arbitrary code execution when combined with specific Java deserialization gadgets. An attacker needs to...

PT-2024-16235 · Google · Car App Android Jetpack Library

Name of the Vulnerable Software and Affected Versions: Car App Android Jetpack Library versions prior to 1.7.0-beta02 Description: The issue is related to a code execution vulnerability in the Car App Android Jetpack Library. Specifically, the CarAppService uses deserialization logic that allows...

CVE-2024-10382: Deserialization of Untrusted Data

There exists a code execution vulnerability in the Car App Android Jetpack Library. CarAppService uses deserialization logic that allows construction of arbitrary java classes. This can lead to arbitrary code execution when combined with specific Java deserialization gadgets. An attacker needs to...