Small number of vulnerabilities patched in last Android security update of 2024
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-43767 | In prepare_to_draw_into_mask of SkBlurMaskFilterImpl.cpp, there is a possible heap overflow due to improper input validation. In prepare_to_draw_into_mask of SkBlurMaskFilterImpl.cpp, there is a possible heap overflow due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. NVD description · AI analysis pending | 8.8 | <1% |
| — |
Full article258 words · extracted from cyberscoop.com · click to collapse
None of the patched bugs were considered critical.
Listen to this article
0:00
Learn more.
Google on Monday released its December 2024 Android Security Bulletin, detailing a range of security vulnerabilities affecting various components across Android devices, with some potentially allowing remote code execution and local escalation of privileges.
The bulletin’s most critical concern centers on vulnerabilities within the system components, which allow developers to build applications with specific functionalities within the Android ecosystem. One particular vulnerability, CVE-2024-43767, allows for remote code execution. The company states that the vulnerability does not require additional execution privileges for a malicious actor to exploit it. Google rated the bug as a “high” severity bug, but it has yet to have a CVE entry in NIST’s National Vulnerability Database (NVD).
Google has ensured that its Android partners were alerted to these issues well in advance, providing a window for necessary adjustments ahead of the patches’ public release. Source code patches for these vulnerabilities have been integrated into the Android Open Source Project (AOSP) repository, with further details and patches to be made accessible from Android partners like MediaTek and Qualcomm.
This month’s bulletin also lists several vulnerabilities that impact components specific to Imagination Technologies, MediaTek, and Qualcomm, with severity levels classified as high.
Beyond system components, the bulletin details vulnerabilities in frameworks that could enable local privilege escalation without additional execution privileges. These are identified by distinct CVE references and affect various Android versions from 12 to 15.
You can read the full bulletin here.
Text extracted automatically; images, tables and formatting may be missing. Original: https://cyberscoop.com/android-security-update-december-2024/