From 1884a14ea7c38167a4d822086d2cbd23872e5b94 Mon Sep 17 00:00:00 2001 From: CVE Team Date: Fri, 16 Feb 2024 01:00:33 +0000 Subject: [PATCH] "-Synchronized-Data." --- 2023/40xxx/CVE-2023-40093.json | 79 ++++++++++++++++++++++++++++++++-- 2023/40xxx/CVE-2023-40122.json | 74 +++++++++++++++++++++++++++++-- 2024/0xxx/CVE-2024-0014.json | 69 +++++++++++++++++++++++++++-- 2024/0xxx/CVE-2024-0029.json | 58 +++++++++++++++++++++++-- 2024/0xxx/CVE-2024-0030.json | 74 +++++++++++++++++++++++++++++-- 2024/0xxx/CVE-2024-0031.json | 74 +++++++++++++++++++++++++++++-- 2024/0xxx/CVE-2024-0032.json | 79 ++++++++++++++++++++++++++++++++-- 2024/0xxx/CVE-2024-0033.json | 79 ++++++++++++++++++++++++++++++++-- 2024/0xxx/CVE-2024-0034.json | 70 ++++++++++++++++++++++++++++-- 2024/0xxx/CVE-2024-0035.json | 74 +++++++++++++++++++++++++++++-- 2024/0xxx/CVE-2024-0036.json | 74 +++++++++++++++++++++++++++++-- 2024/0xxx/CVE-2024-0037.json | 74 +++++++++++++++++++++++++++++-- 2024/0xxx/CVE-2024-0038.json | 58 +++++++++++++++++++++++-- 2024/0xxx/CVE-2024-0040.json | 74 +++++++++++++++++++++++++++++-- 2024/0xxx/CVE-2024-0041.json | 58 +++++++++++++++++++++++-- 2024/25xxx/CVE-2024-25413.json | 61 +++++++++++++++++++++++--- 2024/25xxx/CVE-2024-25414.json | 61 +++++++++++++++++++++++--- 2024/25xxx/CVE-2024-25415.json | 66 +++++++++++++++++++++++++--- 18 files changed, 1178 insertions(+), 78 deletions(-) diff --git a/2023/40xxx/CVE-2023-40093.json b/2023/40xxx/CVE-2023-40093.json index 6c9e5ae495b..7549903ce6d 100644 --- a/2023/40xxx/CVE-2023-40093.json +++ b/2023/40xxx/CVE-2023-40093.json @@ -1,17 +1,88 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2023-40093", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@android.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "In multiple files, there is a possible way that trimmed content could be included in PDF output due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Information disclosure" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Google", + "product": { + "product_data": [ + { + "product_name": "Android", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "14" + }, + { + "version_affected": "=", + "version_value": "13" + }, + { + "version_affected": "=", + "version_value": "12L" + }, + { + "version_affected": "=", + "version_value": "12" + }, + { + "version_affected": "=", + "version_value": "11" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://android.googlesource.com/platform/external/pdfium/+/03925281cf25fec70318bf2225356d022b12b566", + "refsource": "MISC", + "name": "https://android.googlesource.com/platform/external/pdfium/+/03925281cf25fec70318bf2225356d022b12b566" + }, + { + "url": "https://android.googlesource.com/platform/cts/+/a952c93009cc81c41a086d73a4030a83b7683a04", + "refsource": "MISC", + "name": "https://android.googlesource.com/platform/cts/+/a952c93009cc81c41a086d73a4030a83b7683a04" + }, + { + "url": "https://source.android.com/security/bulletin/2024-02-01", + "refsource": "MISC", + "name": "https://source.android.com/security/bulletin/2024-02-01" } ] } diff --git a/2023/40xxx/CVE-2023-40122.json b/2023/40xxx/CVE-2023-40122.json index b4b5a3cfcba..1e500ee3d26 100644 --- a/2023/40xxx/CVE-2023-40122.json +++ b/2023/40xxx/CVE-2023-40122.json @@ -1,17 +1,83 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2023-40122", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@android.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "In applyCustomDescription of SaveUi.java, there is a possible way to view other user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Information disclosure" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Google", + "product": { + "product_data": [ + { + "product_name": "Android", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "14" + }, + { + "version_affected": "=", + "version_value": "13" + }, + { + "version_affected": "=", + "version_value": "12L" + }, + { + "version_affected": "=", + "version_value": "12" + }, + { + "version_affected": "=", + "version_value": "11" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://android.googlesource.com/platform/frameworks/base/+/55fc00a0788ea0995fe0851616b9ac21710a2931", + "refsource": "MISC", + "name": "https://android.googlesource.com/platform/frameworks/base/+/55fc00a0788ea0995fe0851616b9ac21710a2931" + }, + { + "url": "https://source.android.com/security/bulletin/2024-02-01", + "refsource": "MISC", + "name": "https://source.android.com/security/bulletin/2024-02-01" } ] } diff --git a/2024/0xxx/CVE-2024-0014.json b/2024/0xxx/CVE-2024-0014.json index 14c57aa5354..fcab7384b1d 100644 --- a/2024/0xxx/CVE-2024-0014.json +++ b/2024/0xxx/CVE-2024-0014.json @@ -1,17 +1,78 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-0014", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@android.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "In startInstall of UpdateFetcher.java, there is a possible way to trigger a malicious config update due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Elevation of privilege" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Google", + "product": { + "product_data": [ + { + "product_name": "Android", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "14" + }, + { + "version_affected": "=", + "version_value": "13" + }, + { + "version_affected": "=", + "version_value": "12L" + }, + { + "version_affected": "=", + "version_value": "12" + }, + { + "version_affected": "=", + "version_value": "11" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://source.android.com/security/bulletin/2024-02-01", + "refsource": "MISC", + "name": "https://source.android.com/security/bulletin/2024-02-01" } ] } diff --git a/2024/0xxx/CVE-2024-0029.json b/2024/0xxx/CVE-2024-0029.json index 712debcc109..12d352825bd 100644 --- a/2024/0xxx/CVE-2024-0029.json +++ b/2024/0xxx/CVE-2024-0029.json @@ -1,17 +1,67 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-0029", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@android.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "In multiple files, there is a possible way to capture the device screen when disallowed by device policy due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Elevation of privilege" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Google", + "product": { + "product_data": [ + { + "product_name": "Android", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "13" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://android.googlesource.com/platform/frameworks/base/+/9b10fd9718f4e6f6843adbfc14e46a93aab93aad", + "refsource": "MISC", + "name": "https://android.googlesource.com/platform/frameworks/base/+/9b10fd9718f4e6f6843adbfc14e46a93aab93aad" + }, + { + "url": "https://source.android.com/security/bulletin/2024-02-01", + "refsource": "MISC", + "name": "https://source.android.com/security/bulletin/2024-02-01" } ] } diff --git a/2024/0xxx/CVE-2024-0030.json b/2024/0xxx/CVE-2024-0030.json index 0d36bd80361..61db06bf1df 100644 --- a/2024/0xxx/CVE-2024-0030.json +++ b/2024/0xxx/CVE-2024-0030.json @@ -1,17 +1,83 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-0030", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@android.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "In btif_to_bta_response of btif_gatt_util.cc, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Information disclosure" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Google", + "product": { + "product_data": [ + { + "product_name": "Android", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "14" + }, + { + "version_affected": "=", + "version_value": "13" + }, + { + "version_affected": "=", + "version_value": "12L" + }, + { + "version_affected": "=", + "version_value": "12" + }, + { + "version_affected": "=", + "version_value": "11" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/57b823f4f758e2ef530909da07552b5aa80c6a7d", + "refsource": "MISC", + "name": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/57b823f4f758e2ef530909da07552b5aa80c6a7d" + }, + { + "url": "https://source.android.com/security/bulletin/2024-02-01", + "refsource": "MISC", + "name": "https://source.android.com/security/bulletin/2024-02-01" } ] } diff --git a/2024/0xxx/CVE-2024-0031.json b/2024/0xxx/CVE-2024-0031.json index 7839a3a5938..7e1203014e1 100644 --- a/2024/0xxx/CVE-2024-0031.json +++ b/2024/0xxx/CVE-2024-0031.json @@ -1,17 +1,83 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-0031", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@android.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "In attp_build_read_by_type_value_cmd of att_protocol.cc , there is a possible out of bounds write due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Remote code execution" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Google", + "product": { + "product_data": [ + { + "product_name": "Android", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "14" + }, + { + "version_affected": "=", + "version_value": "13" + }, + { + "version_affected": "=", + "version_value": "12L" + }, + { + "version_affected": "=", + "version_value": "12" + }, + { + "version_affected": "=", + "version_value": "11" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/de53890aaca2ae08b3ee2d6e3fd25f702fdfa661", + "refsource": "MISC", + "name": "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/de53890aaca2ae08b3ee2d6e3fd25f702fdfa661" + }, + { + "url": "https://source.android.com/security/bulletin/2024-02-01", + "refsource": "MISC", + "name": "https://source.android.com/security/bulletin/2024-02-01" } ] } diff --git a/2024/0xxx/CVE-2024-0032.json b/2024/0xxx/CVE-2024-0032.json index 97298007202..0652385c8c5 100644 --- a/2024/0xxx/CVE-2024-0032.json +++ b/2024/0xxx/CVE-2024-0032.json @@ -1,17 +1,88 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-0032", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@android.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "In queryChildDocuments of FileSystemProvider.java, there is a possible way to request access to directories that should be hidden due to improper input validation. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Elevation of privilege" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Google", + "product": { + "product_data": [ + { + "product_name": "Android", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "14" + }, + { + "version_affected": "=", + "version_value": "13" + }, + { + "version_affected": "=", + "version_value": "12L" + }, + { + "version_affected": "=", + "version_value": "12" + }, + { + "version_affected": "=", + "version_value": "11" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://android.googlesource.com/platform/packages/providers/DownloadProvider/+/5acd646e0cf63e2c9c0862da7e03531ef0074394", + "refsource": "MISC", + "name": "https://android.googlesource.com/platform/packages/providers/DownloadProvider/+/5acd646e0cf63e2c9c0862da7e03531ef0074394" + }, + { + "url": "https://android.googlesource.com/platform/frameworks/base/+/4af5db76f25348849252e0b8a08f4a517ef842b7", + "refsource": "MISC", + "name": "https://android.googlesource.com/platform/frameworks/base/+/4af5db76f25348849252e0b8a08f4a517ef842b7" + }, + { + "url": "https://source.android.com/security/bulletin/2024-02-01", + "refsource": "MISC", + "name": "https://source.android.com/security/bulletin/2024-02-01" } ] } diff --git a/2024/0xxx/CVE-2024-0033.json b/2024/0xxx/CVE-2024-0033.json index 2065471c4e5..c1d973ce587 100644 --- a/2024/0xxx/CVE-2024-0033.json +++ b/2024/0xxx/CVE-2024-0033.json @@ -1,17 +1,88 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-0033", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@android.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "In multiple functions of ashmem-dev.cpp, there is a possible missing seal due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Elevation of privilege" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Google", + "product": { + "product_data": [ + { + "product_name": "Android", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "14" + }, + { + "version_affected": "=", + "version_value": "13" + }, + { + "version_affected": "=", + "version_value": "12L" + }, + { + "version_affected": "=", + "version_value": "12" + }, + { + "version_affected": "=", + "version_value": "11" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://android.googlesource.com/platform/frameworks/native/+/aa98edf0ce9dde4886979658a459900ca987f193", + "refsource": "MISC", + "name": "https://android.googlesource.com/platform/frameworks/native/+/aa98edf0ce9dde4886979658a459900ca987f193" + }, + { + "url": "https://android.googlesource.com/platform/system/core/+/46d46dc46446f14f26fbe8fb102dd36c1dfc1229", + "refsource": "MISC", + "name": "https://android.googlesource.com/platform/system/core/+/46d46dc46446f14f26fbe8fb102dd36c1dfc1229" + }, + { + "url": "https://source.android.com/security/bulletin/2024-02-01", + "refsource": "MISC", + "name": "https://source.android.com/security/bulletin/2024-02-01" } ] } diff --git a/2024/0xxx/CVE-2024-0034.json b/2024/0xxx/CVE-2024-0034.json index 14f31a24c31..df51754bcab 100644 --- a/2024/0xxx/CVE-2024-0034.json +++ b/2024/0xxx/CVE-2024-0034.json @@ -1,17 +1,79 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-0034", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@android.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "In BackgroundLaunchProcessController, there is a possible way to launch arbitrary activity from the background due to BAL Bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Elevation of privilege" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Google", + "product": { + "product_data": [ + { + "product_name": "Android", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "13" + }, + { + "version_affected": "=", + "version_value": "12L" + }, + { + "version_affected": "=", + "version_value": "12" + }, + { + "version_affected": "=", + "version_value": "11" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://android.googlesource.com/platform/frameworks/base/+/653f7b0d234693309dc86161af01831b64033fe6", + "refsource": "MISC", + "name": "https://android.googlesource.com/platform/frameworks/base/+/653f7b0d234693309dc86161af01831b64033fe6" + }, + { + "url": "https://source.android.com/security/bulletin/2024-02-01", + "refsource": "MISC", + "name": "https://source.android.com/security/bulletin/2024-02-01" } ] } diff --git a/2024/0xxx/CVE-2024-0035.json b/2024/0xxx/CVE-2024-0035.json index 2ca5bc410bc..69e9460f734 100644 --- a/2024/0xxx/CVE-2024-0035.json +++ b/2024/0xxx/CVE-2024-0035.json @@ -1,17 +1,83 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-0035", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@android.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "In onNullBinding of TileLifecycleManager.java, there is a possible way to launch an activity from the background due to a missing null check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Elevation of privilege" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Google", + "product": { + "product_data": [ + { + "product_name": "Android", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "14" + }, + { + "version_affected": "=", + "version_value": "13" + }, + { + "version_affected": "=", + "version_value": "12L" + }, + { + "version_affected": "=", + "version_value": "12" + }, + { + "version_affected": "=", + "version_value": "11" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://android.googlesource.com/platform/frameworks/base/+/7b7fff1eb5014d12200a32ff9047da396c7ab6a4", + "refsource": "MISC", + "name": "https://android.googlesource.com/platform/frameworks/base/+/7b7fff1eb5014d12200a32ff9047da396c7ab6a4" + }, + { + "url": "https://source.android.com/security/bulletin/2024-02-01", + "refsource": "MISC", + "name": "https://source.android.com/security/bulletin/2024-02-01" } ] } diff --git a/2024/0xxx/CVE-2024-0036.json b/2024/0xxx/CVE-2024-0036.json index 3f108ec06da..01e4447aa7e 100644 --- a/2024/0xxx/CVE-2024-0036.json +++ b/2024/0xxx/CVE-2024-0036.json @@ -1,17 +1,83 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-0036", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@android.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "In startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible way to bypass the restrictions on starting activities from the background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Elevation of privilege" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Google", + "product": { + "product_data": [ + { + "product_name": "Android", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "14" + }, + { + "version_affected": "=", + "version_value": "13" + }, + { + "version_affected": "=", + "version_value": "12L" + }, + { + "version_affected": "=", + "version_value": "12" + }, + { + "version_affected": "=", + "version_value": "11" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://android.googlesource.com/platform/frameworks/base/+/3eaaa9687e90c65f51762deb343f18bef95d4e8e", + "refsource": "MISC", + "name": "https://android.googlesource.com/platform/frameworks/base/+/3eaaa9687e90c65f51762deb343f18bef95d4e8e" + }, + { + "url": "https://source.android.com/security/bulletin/2024-02-01", + "refsource": "MISC", + "name": "https://source.android.com/security/bulletin/2024-02-01" } ] } diff --git a/2024/0xxx/CVE-2024-0037.json b/2024/0xxx/CVE-2024-0037.json index bfd2e375044..86d8c4ba892 100644 --- a/2024/0xxx/CVE-2024-0037.json +++ b/2024/0xxx/CVE-2024-0037.json @@ -1,17 +1,83 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-0037", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@android.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "In applyCustomDescription of SaveUi.java, there is a possible way to view images belonging to a different user due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Information disclosure" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Google", + "product": { + "product_data": [ + { + "product_name": "Android", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "14" + }, + { + "version_affected": "=", + "version_value": "13" + }, + { + "version_affected": "=", + "version_value": "12L" + }, + { + "version_affected": "=", + "version_value": "12" + }, + { + "version_affected": "=", + "version_value": "11" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://android.googlesource.com/platform/frameworks/base/+/55fc00a0788ea0995fe0851616b9ac21710a2931", + "refsource": "MISC", + "name": "https://android.googlesource.com/platform/frameworks/base/+/55fc00a0788ea0995fe0851616b9ac21710a2931" + }, + { + "url": "https://source.android.com/security/bulletin/2024-02-01", + "refsource": "MISC", + "name": "https://source.android.com/security/bulletin/2024-02-01" } ] } diff --git a/2024/0xxx/CVE-2024-0038.json b/2024/0xxx/CVE-2024-0038.json index 0763f3421d1..2646923648f 100644 --- a/2024/0xxx/CVE-2024-0038.json +++ b/2024/0xxx/CVE-2024-0038.json @@ -1,17 +1,67 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-0038", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@android.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "In injectInputEventToInputFilter of AccessibilityManagerService.java, there is a possible arbitrary input event injection due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Elevation of privilege" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Google", + "product": { + "product_data": [ + { + "product_name": "Android", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "14" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://android.googlesource.com/platform/frameworks/base/+/3e88d987235f5a2acd50a9b6bad78dbbf39cb079", + "refsource": "MISC", + "name": "https://android.googlesource.com/platform/frameworks/base/+/3e88d987235f5a2acd50a9b6bad78dbbf39cb079" + }, + { + "url": "https://source.android.com/security/bulletin/2024-02-01", + "refsource": "MISC", + "name": "https://source.android.com/security/bulletin/2024-02-01" } ] } diff --git a/2024/0xxx/CVE-2024-0040.json b/2024/0xxx/CVE-2024-0040.json index a72ede2a052..c669685af72 100644 --- a/2024/0xxx/CVE-2024-0040.json +++ b/2024/0xxx/CVE-2024-0040.json @@ -1,17 +1,83 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-0040", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@android.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "In setParameter of MtpPacket.cpp, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Information disclosure" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Google", + "product": { + "product_data": [ + { + "product_name": "Android", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "14" + }, + { + "version_affected": "=", + "version_value": "13" + }, + { + "version_affected": "=", + "version_value": "12L" + }, + { + "version_affected": "=", + "version_value": "12" + }, + { + "version_affected": "=", + "version_value": "11" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://android.googlesource.com/platform/frameworks/av/+/2ca6c27dc0336fd98f47cfb96dc514efa98e8864", + "refsource": "MISC", + "name": "https://android.googlesource.com/platform/frameworks/av/+/2ca6c27dc0336fd98f47cfb96dc514efa98e8864" + }, + { + "url": "https://source.android.com/security/bulletin/2024-02-01", + "refsource": "MISC", + "name": "https://source.android.com/security/bulletin/2024-02-01" } ] } diff --git a/2024/0xxx/CVE-2024-0041.json b/2024/0xxx/CVE-2024-0041.json index d1dd32a517d..71661f19936 100644 --- a/2024/0xxx/CVE-2024-0041.json +++ b/2024/0xxx/CVE-2024-0041.json @@ -1,17 +1,67 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-0041", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@android.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "In removePersistentDot of SystemStatusAnimationSchedulerImpl.kt, there is a possible race condition due to a logic error in the code. This could lead to local escalation of privilege that fails to remove the persistent dot with no additional execution privileges needed. User interaction is not needed for exploitation." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Elevation of privilege" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Google", + "product": { + "product_data": [ + { + "product_name": "Android", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "14" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://android.googlesource.com/platform/frameworks/base/+/d6f7188773409c8f5ad5fc7d3eea5b1751439e26", + "refsource": "MISC", + "name": "https://android.googlesource.com/platform/frameworks/base/+/d6f7188773409c8f5ad5fc7d3eea5b1751439e26" + }, + { + "url": "https://source.android.com/security/bulletin/2024-02-01", + "refsource": "MISC", + "name": "https://source.android.com/security/bulletin/2024-02-01" } ] } diff --git a/2024/25xxx/CVE-2024-25413.json b/2024/25xxx/CVE-2024-25413.json index 776d72dc556..fb70c3a49fb 100644 --- a/2024/25xxx/CVE-2024-25413.json +++ b/2024/25xxx/CVE-2024-25413.json @@ -1,17 +1,66 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { - "ID": "CVE-2024-25413", "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ID": "CVE-2024-25413", + "STATE": "PUBLIC" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A XSLT Server Side injection vulnerability in the Import Jobs function of FireBear Improved Import And Export v3.8.6 allows attackers to execute arbitrary commands via a crafted XSLT file." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://github.com/capture0x/Magento-ver.-2.4.6", + "refsource": "MISC", + "name": "https://github.com/capture0x/Magento-ver.-2.4.6" + }, + { + "url": "https://packetstormsecurity.com/files/175801/FireBear-Improved-Import-And-Export-3.8.6-XSLT-Server-Side-Injection.html", + "refsource": "MISC", + "name": "https://packetstormsecurity.com/files/175801/FireBear-Improved-Import-And-Export-3.8.6-XSLT-Server-Side-Injection.html" } ] } diff --git a/2024/25xxx/CVE-2024-25414.json b/2024/25xxx/CVE-2024-25414.json index 2f954cac81f..8833a52e9c8 100644 --- a/2024/25xxx/CVE-2024-25414.json +++ b/2024/25xxx/CVE-2024-25414.json @@ -1,17 +1,66 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { - "ID": "CVE-2024-25414", "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ID": "CVE-2024-25414", + "STATE": "PUBLIC" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "An arbitrary file upload vulnerability in /admin/upgrade of CSZ CMS v1.3.0 allows attackers to execute arbitrary code via uploading a crafted Zip file." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://packetstormsecurity.com/files/175889/CSZ-CMS-1.3.0-Shell-Upload.html", + "refsource": "MISC", + "name": "https://packetstormsecurity.com/files/175889/CSZ-CMS-1.3.0-Shell-Upload.html" + }, + { + "url": "https://github.com/capture0x/CSZ_CMS", + "refsource": "MISC", + "name": "https://github.com/capture0x/CSZ_CMS" } ] } diff --git a/2024/25xxx/CVE-2024-25415.json b/2024/25xxx/CVE-2024-25415.json index d00ddedf7f9..68d75ae0110 100644 --- a/2024/25xxx/CVE-2024-25415.json +++ b/2024/25xxx/CVE-2024-25415.json @@ -1,17 +1,71 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { - "ID": "CVE-2024-25415", "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ID": "CVE-2024-25415", + "STATE": "PUBLIC" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A remote code execution (RCE) vulnerability in /admin/define_language.php of CE Phoenix v1.0.8.20 allows attackers to execute arbitrary PHP code via injecting a crafted payload into the file english.php." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://github.com/capture0x/Phoenix", + "refsource": "MISC", + "name": "https://github.com/capture0x/Phoenix" + }, + { + "url": "https://packetstormsecurity.com/files/175913/CE-Phoenix-1.0.8.20-Remote-Command-Execution.html", + "refsource": "MISC", + "name": "https://packetstormsecurity.com/files/175913/CE-Phoenix-1.0.8.20-Remote-Command-Execution.html" + }, + { + "url": "https://vulners.com/zdt/1337DAY-ID-39172", + "refsource": "MISC", + "name": "https://vulners.com/zdt/1337DAY-ID-39172" } ] }