LeakValue

Android 13은 Parcel 직렬화 메커니즘을 강화하기 위해 많은 개선 사항을 도입합니다. Android 보안 및 개인정보 보호 팀이 만든 개선 사항에 대한 프레젠테이션은 여기 있습니다 훌륭한 일이며, 많은 취약점을 확실히 제거하거나 악용 불가능하게 만듭니다. 또한 그들은 앱이 다른 앱시스템 앱 포함에 자신의 코드를 로드할 수 있게 해주는 이전 익스플로잇을 무력화시키는 방법을 설명합니다. 하지만 이제 저는 같은 결과를 다른 방식으로 달성하는 새로운 익스플로잇을 가지고 돌아왔습니다. 이 익스플로잇은 앞서 언급한 Parcel...

ResourcePoison

이 문제에 대한 수정 사항이 CVE-2025-22441로 공개되었습니다: 공지 패치 후속 조치 ApplicationInfo 전달하기 ApplicationInfo는 설치된 앱에 대한 다양한 정보를 정의하는 구조체로, 가장 주목할 만한 것은 리소스와 코드가 로드되는 apk 파일의 경로입니다. 일반적으로 시스템에서 애플리케이션으로 전달되지만, 비시스템 호출자가 자체 객체를 제공할 수 있는 경우도 있습니다. 예를 들어 과거에는 bindBackupAgent 메서드의 취약점이 있었는데, 공격자가 매개변수로 자체 ApplicationInf...

CVE-2021-0970

In createFromParcel of GpsNavigationMessage.java, there is a possible Parcel serialization/deserialization mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-1...

EUVD-2018-21117

Malware in sbrugna...

EUVD-2021-26033

Malware in sbrugna...

EUVD-2021-3540

Malicious code in bioql PyPI...

EUVD-2021-3304

Malicious code in bioql PyPI...

EUVD-2021-3589

Malicious code in bioql PyPI...

CVE-2021-39676

In writeThrowable of AndroidFuture.java, there is a possible parcel serialization/deserialization mismatch due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

PT-2025-2844 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android affected versions not specified Description: The issue is related to insufficient input validation in a component of the Android operating system framework. This could allow an attacker to elevate their privileges. There have been...

CVE-2021-39676

In writeThrowable of AndroidFuture.java, there is a possible parcel serialization/deserialization mismatch due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

Input validation

In writeThrowable of AndroidFuture.java, there is a possible parcel serialization/deserialization mismatch due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

CVE-2021-39676

In writeThrowable of AndroidFuture.java, there is a possible parcel serialization/deserialization mismatch due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

PT-2022-10961 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android version 11 Description: The issue is related to a parcel serialization/deserialization mismatch in the writeThrowable function of AndroidFuture.java due to improper input validation. This could lead to local escalation of privilege wi...

CVE-2021-39676: Improper Input Validation

In writeThrowable of AndroidFuture.java, there is a possible parcel serialization/deserialization mismatch due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

ASB-A-197228210

In writeThrowable of AndroidFuture.java, there is a possible parcel serialization/deserialization mismatch due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2021-0970

In createFromParcel of GpsNavigationMessage.java, there is a possible Parcel serialization/deserialization mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-1...

CVE-2021-0970

In createFromParcel of GpsNavigationMessage.java, there is a possible Parcel serialization/deserialization mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-1...

CVE-2021-0928

In createFromParcel of OutputConfiguration.java, there is a possible parcel serialization/deserialization mismatch due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

CVE-2021-0921

In ParsingPackageImpl of ParsingPackageImpl.java, there is a possible parcel serialization/deserialization mismatch due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...