SB2023080501 - Multiple vulnerabilities in Unisoc chipsets
Published: August 5, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 11 secuirty vulnerabilities.
1) Information exposure (CVE-ID: CVE-2023-33906)
The vulnerability allows a local privileged application to gain access to sensitive information.
The vulnerability exists due to a possible missing permission check within the Contacts Service in Android. A local privileged application can gain access to sensitive information.
2) Missing Authorization (CVE-ID: CVE-2023-33907)
The vulnerability allows a local privileged application to gain access to sensitive information.
The vulnerability exists due to a possible missing permission check within the Contacts Service in Android. A local privileged application can gain access to sensitive information.
3) Information exposure (CVE-ID: CVE-2023-33908)
The vulnerability allows a local privileged application to gain access to sensitive information.
The vulnerability exists due to a possible missing permission check within the ims service in Android. A local privileged application can gain access to sensitive information.
4) Information exposure (CVE-ID: CVE-2023-33909)
The vulnerability allows a local privileged application to gain access to sensitive information.
The vulnerability exists due to a possible missing permission check within the Contacts service in Android. A local privileged application can gain access to sensitive information.
5) Information exposure (CVE-ID: CVE-2023-33910)
The vulnerability allows a local privileged application to gain access to sensitive information.
The vulnerability exists due to a possible missing permission check within the Contacts Service in Android. A local privileged application can gain access to sensitive information.
6) Information exposure (CVE-ID: CVE-2023-33911)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a possible missing permission check within the vowifi service in Android. A local application can gain access to sensitive information.
7) Information exposure (CVE-ID: CVE-2023-33912)
The vulnerability allows a local privileged application to gain access to sensitive information.
The vulnerability exists due to a possible missing permission check within the Contacts service in Android. A local privileged application can gain access to sensitive information.
8) Out-of-bounds read (CVE-ID: CVE-2022-47350)
The vulnerability allows a local application to manipulate or delete data.
The vulnerability exists due to a possible out of bounds read due to a missing bounds check within the camera driver in Kernel. A local application can manipulate or delete data.
9) Out-of-bounds read (CVE-ID: CVE-2022-47351)
The vulnerability allows a local application to manipulate or delete data.
The vulnerability exists due to a possible out of bounds read due to a missing bounds check within the camera driver in Kernel. A local application can manipulate or delete data.
10) Comparison Logic is Vulnerable to Power Side-Channel Attacks (CVE-ID: CVE-2023-3630)
The vulnerability allows a local attacker to read and manipulate data.
The vulnerability exists due to a missing permission check within the Mocor system in Mocor. A local attacker can read and manipulate data.
11) Buffer overflow (CVE-ID: CVE-2023-33913)
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to a possible out of bounds write due to an incorrect calculation of buffer size within the DRM/oemcrypto in Android. A remote attacker can execute arbitrary code.
Remediation
Install update from vendor's website.