CVE-2023-21179

In parseSecurityParamsFromXml of XmlUtil.java, there is a possible bypass of user specified wifi encryption protocol due to improperly used crypto. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

CVE-2023-21212

In multiple files, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure in the wifi server with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID:...

PT-2023-18002 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-13 Description: The issue is related to a possible out of bounds read due to a missing bounds check in multiple files. This could lead to local information disclosure in the wifi server, with System execution privileg...

Google Pixel 安全漏洞

Google Pixel is a smartphone from Google USA. Google Pixel suffers from a security vulnerability that stems from multiple functions in WifiNetworkFactory.java, which could lead to local privilege escalation due to a lack of privilege checking...

PT-2023-17973 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-13 Description: The issue is related to a missing permission check in multiple functions of WifiNetworkFactory.java. This could lead to local escalation of privilege from the guest user with no additional execution...

CVE-2023-21179

In parseSecurityParamsFromXml of XmlUtil.java, there is a possible bypass of user specified wifi encryption protocol due to improperly used crypto. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

PT-2023-17967 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-13 Description: The issue is related to a possible bypass of user-specified wifi encryption protocol due to improperly used crypto in the parseSecurityParamsFromXml function of XmlUtil.java. This could lead to local...

CVE-2023-21204

CVE-2023-21204 is described in the provided documents as an out-of-bounds read in multiple files affecting the Android wifi server, enabling local information disclosure and requiring System-level privileges for exploitation, with no user interaction needed. The Android Pixel security bulletin li...

CVE-2023-21204

In multiple files, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure in the wifi server with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID:...

Google Pixel 缓冲区错误漏洞

Google Pixel is a smartphone from the American company Google Google. Google Pixel suffers from a security vulnerability that stems from a possible out-of-bounds read in multiple files due to a lack of boundary checking, which could lead to the disclosure of local information in wifi servers...

CVE-2023-21212

In multiple files, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure in the wifi server with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID:...

CVE-2023-21179

CVE-2023-21179 affects Android 13 and involves XmlUtil.java’s parseSecurityParamsFromXml. The root issue is a weakness in how crypto is used, allowing bypass of a user-specified wifi encryption protocol, enabling local privilege escalation with no additional execution privileges or user interacti...

CVE-2022-40010

CVE-2022-40010 affects the Tenda AC6 AC1200 Smart Dual-Band WiFi Router (Parental Control module). The vulnerability is a cross-site scripting (XSS) flaw via the deviceId parameter in the Parental Control section. The available documents describe a stored XSS vector and confirm the issue exists i...

CVE-2023-3317

A use-after-free flaw was found in mt7921checkoffloadcapability in drivers/net/wireless/mediatek/mt76/mt7921/init.c in wifi mt76/mt7921 sub-component in the Linux Kernel. This flaw could allow an attacker to crash the system after 'features' memory release. This vulnerability could even lead to a...

USN-6186-1: Linux kernel vulnerabilities

Patryk Sondej and Piotr Krysiuk discovered that a race condition existed in the netfilter subsystem of the Linux kernel when processing batch requests, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrar...

LSN-0095-1: Kernel Live Patch Security Notice

It was discovered that the OverlayFS implementation in the Linux kernel did not properly handle copy up operation in some conditions. A local attacker could possibly use this to gain elevated privileges.CVE-2023-0386 It was discovered that the Broadcom FullMAC USB WiFi driver in the Linux kernel...

LSN-0095-1 Kernel Live Patch Security Notice

It was discovered that the OverlayFS implementation in the Linux kernel did not properly handle copy up operation in some conditions. A local attacker could possibly use this to gain elevated privileges.CVE-2023-0386 It was discovered that the Broadcom FullMAC USB WiFi driver in the Linux kernel...

A week in security (June 12 - 18)

Last week on Malwarebytes Labs: MOVEit discloses THIRD critical vulnerability Fake security researchers push malware files on GitHub LockBit ransomware advisory from CISA provides interesting insights Microsoft fixes six critical vulnerabilities in June Patch Tuesday Update Chrome now! Google fix...

USN-6175-1: Linux kernel vulnerabilities

Patryk Sondej and Piotr Krysiuk discovered that a race condition existed in the netfilter subsystem of the Linux kernel when processing batch requests, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrar...

USN-6173-1: Linux kernel (OEM) vulnerabilities

Gwangun Jung discovered that the Quick Fair Queueing scheduler implementation in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2023-31436 It was discovered that the...