From e72eb7e5bb88ffb517f0e72b2ac4d752d8f45c78 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 11 Sep 2024 00:32:12 +0000 Subject: [PATCH] Publish Advisories GHSA-46ph-452x-f4g5 GHSA-wmqw-xg54-ch38 GHSA-33jw-2jpq-625x GHSA-5f45-24fp-cx62 GHSA-84cg-qrp2-5ch9 GHSA-8m3r-rfc5-mrmg GHSA-g3p7-6jrm-6c7q GHSA-hh5f-w8h8-vh35 GHSA-mg6p-4qg9-v4wv GHSA-mgrp-q987-h8p8 GHSA-mmp2-p685-v76h GHSA-p5wh-m438-q8hr GHSA-rhxj-v9fc-vpm2 GHSA-vj44-f7fj-3gf2 GHSA-xgpg-34fv-3xwr --- .../GHSA-46ph-452x-f4g5.json | 2 +- .../GHSA-wmqw-xg54-ch38.json | 2 +- .../GHSA-33jw-2jpq-625x.json | 11 ++++-- .../GHSA-5f45-24fp-cx62.json | 39 +++++++++++++++++++ .../GHSA-84cg-qrp2-5ch9.json | 39 +++++++++++++++++++ .../GHSA-8m3r-rfc5-mrmg.json | 39 +++++++++++++++++++ .../GHSA-g3p7-6jrm-6c7q.json | 39 +++++++++++++++++++ .../GHSA-hh5f-w8h8-vh35.json | 39 +++++++++++++++++++ .../GHSA-mg6p-4qg9-v4wv.json | 39 +++++++++++++++++++ .../GHSA-mgrp-q987-h8p8.json | 39 +++++++++++++++++++ .../GHSA-mmp2-p685-v76h.json | 35 +++++++++++++++++ .../GHSA-p5wh-m438-q8hr.json | 35 +++++++++++++++++ .../GHSA-rhxj-v9fc-vpm2.json | 11 ++++-- .../GHSA-vj44-f7fj-3gf2.json | 39 +++++++++++++++++++ .../GHSA-xgpg-34fv-3xwr.json | 39 +++++++++++++++++++ 15 files changed, 437 insertions(+), 10 deletions(-) create mode 100644 advisories/unreviewed/2024/09/GHSA-5f45-24fp-cx62/GHSA-5f45-24fp-cx62.json create mode 100644 advisories/unreviewed/2024/09/GHSA-84cg-qrp2-5ch9/GHSA-84cg-qrp2-5ch9.json create mode 100644 advisories/unreviewed/2024/09/GHSA-8m3r-rfc5-mrmg/GHSA-8m3r-rfc5-mrmg.json create mode 100644 advisories/unreviewed/2024/09/GHSA-g3p7-6jrm-6c7q/GHSA-g3p7-6jrm-6c7q.json create mode 100644 advisories/unreviewed/2024/09/GHSA-hh5f-w8h8-vh35/GHSA-hh5f-w8h8-vh35.json create mode 100644 advisories/unreviewed/2024/09/GHSA-mg6p-4qg9-v4wv/GHSA-mg6p-4qg9-v4wv.json create mode 100644 advisories/unreviewed/2024/09/GHSA-mgrp-q987-h8p8/GHSA-mgrp-q987-h8p8.json create mode 100644 advisories/unreviewed/2024/09/GHSA-mmp2-p685-v76h/GHSA-mmp2-p685-v76h.json create mode 100644 advisories/unreviewed/2024/09/GHSA-p5wh-m438-q8hr/GHSA-p5wh-m438-q8hr.json create mode 100644 advisories/unreviewed/2024/09/GHSA-vj44-f7fj-3gf2/GHSA-vj44-f7fj-3gf2.json create mode 100644 advisories/unreviewed/2024/09/GHSA-xgpg-34fv-3xwr/GHSA-xgpg-34fv-3xwr.json diff --git a/advisories/unreviewed/2023/10/GHSA-46ph-452x-f4g5/GHSA-46ph-452x-f4g5.json b/advisories/unreviewed/2023/10/GHSA-46ph-452x-f4g5/GHSA-46ph-452x-f4g5.json index 87ed09eef79..d5be269b523 100644 --- a/advisories/unreviewed/2023/10/GHSA-46ph-452x-f4g5/GHSA-46ph-452x-f4g5.json +++ b/advisories/unreviewed/2023/10/GHSA-46ph-452x-f4g5/GHSA-46ph-452x-f4g5.json @@ -28,7 +28,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-284" ], "severity": "CRITICAL", "github_reviewed": false, diff --git a/advisories/unreviewed/2023/10/GHSA-wmqw-xg54-ch38/GHSA-wmqw-xg54-ch38.json b/advisories/unreviewed/2023/10/GHSA-wmqw-xg54-ch38/GHSA-wmqw-xg54-ch38.json index 44527fe854c..55881d6c5be 100644 --- a/advisories/unreviewed/2023/10/GHSA-wmqw-xg54-ch38/GHSA-wmqw-xg54-ch38.json +++ b/advisories/unreviewed/2023/10/GHSA-wmqw-xg54-ch38/GHSA-wmqw-xg54-ch38.json @@ -36,7 +36,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-358" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/09/GHSA-33jw-2jpq-625x/GHSA-33jw-2jpq-625x.json b/advisories/unreviewed/2024/09/GHSA-33jw-2jpq-625x/GHSA-33jw-2jpq-625x.json index 34e97abbf44..d93edbfcfb4 100644 --- a/advisories/unreviewed/2024/09/GHSA-33jw-2jpq-625x/GHSA-33jw-2jpq-625x.json +++ b/advisories/unreviewed/2024/09/GHSA-33jw-2jpq-625x/GHSA-33jw-2jpq-625x.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-33jw-2jpq-625x", - "modified": "2024-09-10T18:30:44Z", + "modified": "2024-09-11T00:30:51Z", "published": "2024-09-10T18:30:44Z", "aliases": [ "CVE-2023-37233" ], "details": "Loftware Spectrum before 4.6 HF14 allows authenticated XXE attacks.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -33,9 +36,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-611" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-09-10T16:15:18Z" diff --git a/advisories/unreviewed/2024/09/GHSA-5f45-24fp-cx62/GHSA-5f45-24fp-cx62.json b/advisories/unreviewed/2024/09/GHSA-5f45-24fp-cx62/GHSA-5f45-24fp-cx62.json new file mode 100644 index 00000000000..b550fc0923c --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-5f45-24fp-cx62/GHSA-5f45-24fp-cx62.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5f45-24fp-cx62", + "modified": "2024-09-11T00:30:51Z", + "published": "2024-09-11T00:30:51Z", + "aliases": [ + "CVE-2024-40657" + ], + "details": "In addPreferencesForType of AccountTypePreferenceLoader.java, there is a possible way to disable apps for other users due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40657" + }, + { + "type": "WEB", + "url": "https://android.googlesource.com/platform/packages/apps/Settings/+/8261e0ade3b414fea61d7fe9d8bc6df7a3fc8603" + }, + { + "type": "WEB", + "url": "https://source.android.com/security/bulletin/2024-09-01" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-11T00:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-84cg-qrp2-5ch9/GHSA-84cg-qrp2-5ch9.json b/advisories/unreviewed/2024/09/GHSA-84cg-qrp2-5ch9/GHSA-84cg-qrp2-5ch9.json new file mode 100644 index 00000000000..e731f473412 --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-84cg-qrp2-5ch9/GHSA-84cg-qrp2-5ch9.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-84cg-qrp2-5ch9", + "modified": "2024-09-11T00:30:51Z", + "published": "2024-09-11T00:30:51Z", + "aliases": [ + "CVE-2024-40652" + ], + "details": "In onCreate of SettingsHomepageActivity.java, there is a possible way to access the Settings app while the device is provisioning due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40652" + }, + { + "type": "WEB", + "url": "https://android.googlesource.com/platform/packages/apps/Settings/+/2909433f7d59dcdd0c74044b1c8e9f48927193dc" + }, + { + "type": "WEB", + "url": "https://source.android.com/security/bulletin/2024-09-01" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-11T00:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-8m3r-rfc5-mrmg/GHSA-8m3r-rfc5-mrmg.json b/advisories/unreviewed/2024/09/GHSA-8m3r-rfc5-mrmg/GHSA-8m3r-rfc5-mrmg.json new file mode 100644 index 00000000000..2a776e5286e --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-8m3r-rfc5-mrmg/GHSA-8m3r-rfc5-mrmg.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8m3r-rfc5-mrmg", + "modified": "2024-09-11T00:30:51Z", + "published": "2024-09-11T00:30:51Z", + "aliases": [ + "CVE-2024-40654" + ], + "details": "In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40654" + }, + { + "type": "WEB", + "url": "https://android.googlesource.com/platform/packages/apps/Settings/+/f1d0079c91734168c150f839168544f407b17b06" + }, + { + "type": "WEB", + "url": "https://source.android.com/security/bulletin/2024-09-01" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-11T00:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-g3p7-6jrm-6c7q/GHSA-g3p7-6jrm-6c7q.json b/advisories/unreviewed/2024/09/GHSA-g3p7-6jrm-6c7q/GHSA-g3p7-6jrm-6c7q.json new file mode 100644 index 00000000000..8dce5be2d62 --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-g3p7-6jrm-6c7q/GHSA-g3p7-6jrm-6c7q.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g3p7-6jrm-6c7q", + "modified": "2024-09-11T00:30:51Z", + "published": "2024-09-11T00:30:51Z", + "aliases": [ + "CVE-2024-40659" + ], + "details": "In getRegistration of RemoteProvisioningService.java, there is a possible way to permanently disable the AndroidKeyStore key generation feature by updating the attestation keys of all installed apps due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40659" + }, + { + "type": "WEB", + "url": "https://android.googlesource.com/platform/packages/modules/RemoteKeyProvisioning/+/c65dce4c6d8d54e47dce79a56e29e2223a2354e6" + }, + { + "type": "WEB", + "url": "https://source.android.com/security/bulletin/2024-09-01" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-11T00:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-hh5f-w8h8-vh35/GHSA-hh5f-w8h8-vh35.json b/advisories/unreviewed/2024/09/GHSA-hh5f-w8h8-vh35/GHSA-hh5f-w8h8-vh35.json new file mode 100644 index 00000000000..34db0562c36 --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-hh5f-w8h8-vh35/GHSA-hh5f-w8h8-vh35.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hh5f-w8h8-vh35", + "modified": "2024-09-11T00:30:51Z", + "published": "2024-09-11T00:30:51Z", + "aliases": [ + "CVE-2024-40650" + ], + "details": "In wifi_item_edit_content of styles.xml , there is a possible FRP bypass due to Missing check for FRP state. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40650" + }, + { + "type": "WEB", + "url": "https://android.googlesource.com/platform/packages/apps/Settings/+/2968ccc911956fa5813a9a6a5e5c8970e383a60f" + }, + { + "type": "WEB", + "url": "https://source.android.com/security/bulletin/2024-09-01" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-11T00:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-mg6p-4qg9-v4wv/GHSA-mg6p-4qg9-v4wv.json b/advisories/unreviewed/2024/09/GHSA-mg6p-4qg9-v4wv/GHSA-mg6p-4qg9-v4wv.json new file mode 100644 index 00000000000..2b198a8d02d --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-mg6p-4qg9-v4wv/GHSA-mg6p-4qg9-v4wv.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mg6p-4qg9-v4wv", + "modified": "2024-09-11T00:30:51Z", + "published": "2024-09-11T00:30:51Z", + "aliases": [ + "CVE-2024-40655" + ], + "details": "In bindAndGetCallIdentification of CallScreeningServiceHelper.java, there is a possible way to maintain a while-in-use permission in the background due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40655" + }, + { + "type": "WEB", + "url": "https://android.googlesource.com/platform/packages/services/Telecomm/+/eeef54b37a362f506ea3aa155baddc545b6a909a" + }, + { + "type": "WEB", + "url": "https://source.android.com/security/bulletin/2024-09-01" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-11T00:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-mgrp-q987-h8p8/GHSA-mgrp-q987-h8p8.json b/advisories/unreviewed/2024/09/GHSA-mgrp-q987-h8p8/GHSA-mgrp-q987-h8p8.json new file mode 100644 index 00000000000..0e01caa0779 --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-mgrp-q987-h8p8/GHSA-mgrp-q987-h8p8.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mgrp-q987-h8p8", + "modified": "2024-09-11T00:30:51Z", + "published": "2024-09-11T00:30:51Z", + "aliases": [ + "CVE-2024-40656" + ], + "details": "In handleCreateConferenceComplete of ConnectionServiceWrapper.java, there is a possible way to reveal images across users due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40656" + }, + { + "type": "WEB", + "url": "https://android.googlesource.com/platform/packages/services/Telecomm/+/f3e6a6c02439401eb7aeb3749ee5ec0b51a625b9" + }, + { + "type": "WEB", + "url": "https://source.android.com/security/bulletin/2024-09-01" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-11T00:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-mmp2-p685-v76h/GHSA-mmp2-p685-v76h.json b/advisories/unreviewed/2024/09/GHSA-mmp2-p685-v76h/GHSA-mmp2-p685-v76h.json new file mode 100644 index 00000000000..dd4b3a15aef --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-mmp2-p685-v76h/GHSA-mmp2-p685-v76h.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mmp2-p685-v76h", + "modified": "2024-09-11T00:30:51Z", + "published": "2024-09-11T00:30:51Z", + "aliases": [ + "CVE-2024-23716" + ], + "details": "In DevmemIntPFNotify of devicemem_server.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23716" + }, + { + "type": "WEB", + "url": "https://source.android.com/security/bulletin/2024-09-01" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-11T00:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-p5wh-m438-q8hr/GHSA-p5wh-m438-q8hr.json b/advisories/unreviewed/2024/09/GHSA-p5wh-m438-q8hr/GHSA-p5wh-m438-q8hr.json new file mode 100644 index 00000000000..c0f66adab84 --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-p5wh-m438-q8hr/GHSA-p5wh-m438-q8hr.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-p5wh-m438-q8hr", + "modified": "2024-09-11T00:30:51Z", + "published": "2024-09-11T00:30:51Z", + "aliases": [ + "CVE-2024-31336" + ], + "details": "N/A", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31336" + }, + { + "type": "WEB", + "url": "https://source.android.com/security/bulletin/2024-09-01" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-11T00:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-rhxj-v9fc-vpm2/GHSA-rhxj-v9fc-vpm2.json b/advisories/unreviewed/2024/09/GHSA-rhxj-v9fc-vpm2/GHSA-rhxj-v9fc-vpm2.json index 2ecfa0c7575..4a3dfccb301 100644 --- a/advisories/unreviewed/2024/09/GHSA-rhxj-v9fc-vpm2/GHSA-rhxj-v9fc-vpm2.json +++ b/advisories/unreviewed/2024/09/GHSA-rhxj-v9fc-vpm2/GHSA-rhxj-v9fc-vpm2.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-rhxj-v9fc-vpm2", - "modified": "2024-09-10T18:30:44Z", + "modified": "2024-09-11T00:30:51Z", "published": "2024-09-10T18:30:44Z", "aliases": [ "CVE-2024-44815" ], "details": "An issue in Hathway Skyworth Router CM5100 v.4.1.1.24 allows a physically proximate attacker to obtain sensitive information via SPI flash Firmware W25Q64JV", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-256" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-09-10T16:15:20Z" diff --git a/advisories/unreviewed/2024/09/GHSA-vj44-f7fj-3gf2/GHSA-vj44-f7fj-3gf2.json b/advisories/unreviewed/2024/09/GHSA-vj44-f7fj-3gf2/GHSA-vj44-f7fj-3gf2.json new file mode 100644 index 00000000000..e49cf053321 --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-vj44-f7fj-3gf2/GHSA-vj44-f7fj-3gf2.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vj44-f7fj-3gf2", + "modified": "2024-09-11T00:30:51Z", + "published": "2024-09-11T00:30:51Z", + "aliases": [ + "CVE-2024-40662" + ], + "details": "In scheme of Uri.java, there is a possible way to craft a malformed Uri object due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40662" + }, + { + "type": "WEB", + "url": "https://android.googlesource.com/platform/frameworks/base/+/e7af00cafb52a25933ec4edb80c5111d42af0237" + }, + { + "type": "WEB", + "url": "https://source.android.com/security/bulletin/2024-09-01" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-11T00:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-xgpg-34fv-3xwr/GHSA-xgpg-34fv-3xwr.json b/advisories/unreviewed/2024/09/GHSA-xgpg-34fv-3xwr/GHSA-xgpg-34fv-3xwr.json new file mode 100644 index 00000000000..2d88228d99a --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-xgpg-34fv-3xwr/GHSA-xgpg-34fv-3xwr.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xgpg-34fv-3xwr", + "modified": "2024-09-11T00:30:51Z", + "published": "2024-09-11T00:30:51Z", + "aliases": [ + "CVE-2024-40658" + ], + "details": "In getConfig of SoftVideoDecoderOMXComponent.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40658" + }, + { + "type": "WEB", + "url": "https://android.googlesource.com/platform/frameworks/av/+/6d23fa05a40e5462d4b9bad28afa932e6e12a4f3" + }, + { + "type": "WEB", + "url": "https://source.android.com/security/bulletin/2024-09-01" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-11T00:15:11Z" + } +} \ No newline at end of file