Pixel Update Bulletin—July 2024Stay organized with collectionsSave and categorize content based on your preferences.

The Pixel Update Bulletin contains details of security vulnerabilities and functional improvements affecting supported Pixel devices Google devices. For Google devices, security patch levels of 2024-07-05 or later address all issues in this bulletin and all issues in the July 2024 Android Securit...

Pixman: Heap Buffer Overflow

Background Pixman is a pixel manipulation library. Description A vulnerability has been discovered in Pixman. Please review the CVE identifiers referenced below for details. Impact An out-of-bounds write aka heap-based buffer overflow in rasterizeedges8 can occur due to an integer overflow in...

Exploit for Use After Free in Arm Avalon_Gpu_Kernel_Driver

Exploit for CVE-2022-46395 The write up can be found here...

Exploit for Improper Input Validation in Google Android

Exploit for CVE-2022-20186 The write up can be found here...

A week in security (June 10 – June 16)

Last week on Malwarebytes Labs: Truist bank confirms data breach Update now! Google Pixel vulnerability is under active exploitation Adobe clarifies Terms of Service change, says it doesn’t train AI on customer content 23andMe data breach under joint investigation in two countries When things go...

OPENSUSE-SU-2024:10229-1 gdk-pixbuf-loader-rsvg-2.40.16-1.4 on GA media

These are all security issues fixed in the gdk-pixbuf-loader-rsvg-2.40.16-1.4 package on the GA media of openSUSE Tumbleweed...

CVE-2024-4005

The Social Pixel WordPress plugin through 2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-4005

The Social Pixel WordPress plugin through 2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-4005 Social Pixel <= 2.1 - Admin+ Stored XSS

The Social Pixel WordPress plugin through 2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-4005 Social Pixel <= 2.1 - Admin+ Stored XSS

The Social Pixel WordPress plugin through 2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

WordPress plugin Social Pixel security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security vulnerability...

PT-2024-28767 · WordPress · Social Pixel

Name of the Vulnerable Software and Affected Versions: The Social Pixel WordPress plugin versions through 2.1 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example, in...

CVE-2024-32929

In gpuslcgetregion of pixelgpuslc.c, there is a possible EoP due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

Update now! Google Pixel vulnerability is under active exploitation

Google has notified Pixel users about an actively exploited vulnerability in their phones firmware. Firmware is the code or program which is embedded into hardware devices. Simply put, it is the software layer between the hardware and the applications on the device. About the vulnerability, Googl...

Google Warns of Pixel Firmware Security Flaw Exploited as Zero-Day

Google has warned that a security flaw impacting Pixel Firmware has been exploited in the wild as a zero-day. The high-severity vulnerability, tagged as CVE-2024-32896, has been described as an elevation of privilege issue in Pixel Firmware. The company did not share any additional details relate...

Google Pixel Security Breach

Google Pixel is a smartphone from Google, an American company. A security vulnerability exists in Google Pixel, which stems from a race condition in the gpupmpowerofftopnolock module of pixelgpupower.c that could compromise protected memory...

Google Pixel Security Breach

Google Pixel is a smartphone from Google, an American company. A security vulnerability exists in Google Pixel, which stems from a lack of bounds checking in the pktprocfilldataaddrwithoutbm module of linkrxpktproc.c, where out-of-bounds writes may exist...

Google Pixel Security Breach

Google Pixel is a smartphone from Google, an American company. A security vulnerability exists in Google Pixel, which stems from a type confusion in the handleinit module of goodix/main/main.c, where memory corruption may occur...

Google Pixel Security Breach

Google Pixel is a smartphone from Google Inc USA. A security vulnerability exists in Google Pixel, which stems from an incorrect bounds check in the circread module of linkdevicememorylegacy.c, where out-of-bounds writes may occur...

Google Pixel Security Breach

Google Pixel is a smartphone from Google USA. Google Pixel suffers from a security vulnerability that stems from test/debug code left behind in the production version, which could be a persistent denial of service...