Vulnerabilitycritical
Google fixed a critical Remote Code Execution flaw in Android
- CVEs
- CVE-2021-0316CVE-2021-0313CVE-2020-11134CVE-2020-11182CVE-2021-0303CVE-2021-0306CVE-2021-0307CVE-2021-0310CVE-2021-0315CVE-2021-0317CVE-2021-0318CVE-2021-0319CVE-2021-0304CVE-2021-0309CVE-2021-0321CVE-2021-0322CVE-2019-9376CVE-2021-0311CVE-2021-0312CVE-2021-0308CVE-2021-0320CVE-2020-0471CVE-2020-10732CVE-2020-10766CVE-2021-0323CVE-2021-0301CVE-2020-11233CVE-2020-11239CVE-2020-11220CVE-2020-11250CVE-2020-11261CVE-2020-11262CVE-2020-11126CVE-2020-11159CVE-2020-11181CVE-2020-11235CVE-2020-11238CVE-2020-11241CVE-2020-11260
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2019-9376 | In Account of Account.java, there is a possible boot loop due to improper input validation | 5.5 | <1% | ||
| CVE-2021-0316 | In avrc_pars_vendor_cmd of avrc_pars_tg.cc, there is a possible out of bounds write due to a missing bounds check | 9.8 group max | 3% | ||
| CVE-2020-10732 | Linux kernel's implementation of Userspace core dumps: This flaw allows an attacker with a local account to crash a trivial program and exfiltrate private kernel data | 4.4 | <1% | ||
| CVE-2020-10766 | A logic bug flaw was found in Linux kernel before 5.8-rc1 in the implementation of SSBD | 5.5 | <1% | ||
| CVE-2020-11126 | Possible out of bound read while WLAN frame parsing due to lack of check for body and header length in Snapdragon Auto, Snapdragon Compute, Snapdragon… | 9.1 | <1% | ||
CVE-2020-11182+2 related CVEs | Possible heap overflow while parsing NAL header due to lack of check of length of data received from user in Snapdragon Auto, Snapdragon Compute, Snapdragon… | 9.8 group max | <1% | ||
| CVE-2020-11159 | Buffer over-read can happen while processing WPA,RSN IE of beacon and response frames if IE length is less than length of frame pointer being accessed in… | 9.1 group max | <1% | ||
| CVE-2020-11181 | Out of bound access issue while handling cvp process control command due to improper validation of buffer pointer received from HLOS in Snapdragon Compute… | 7.8 | <1% | ||
| CVE-2020-11220 | While processing storage SCM commands there is a time of check or time of use window where a pointer used could be invalid at a specific time while executing… | 6.4 | <1% | ||
| CVE-2020-11250 | Use after free due to race condition when reopening the device driver repeatedly in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon… | 7.0 | <1% | ||
| CVE-2020-11260 | An improper free of uninitialized memory can occur in DIAG services in Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile | 8.4 | <1% | ||
| CVE-2020-11261 | Local Privilege Escalation via Memory Corruption in Qualcomm Snapdragon Chipsets | 7.8 | 2% | KEV | KEV |
| CVE-2021-0323 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority | — | — |
From the original article
1 min read at securityaffairs.com
Google released an Android security update that addressed tens of flaws, including a critical Android remote code execution vulnerability. Google released an Android security update that addresses 43 flaws, including a critical remote code execution vulnerability in the Android System component tracked as CVE-2021-0316. Google addressed the flaws with the release of Security patch levels of 2021-01-05 or later.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.