CVE-2023-21287

In multiple locations, there is a possible code execution due to type confusion. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://android.googlesource.com/platform/external/freetype/+/a79e80a25874dacaa266906a9048f13d4bac41c6	Patch
https://source.android.com/security/bulletin/2023-08-01	Patch Vendor Advisory
https://android.googlesource.com/platform/external/freetype/+/a79e80a25874dacaa266906a9048f13d4bac41c6	Patch
https://source.android.com/security/bulletin/2023-08-01	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:google:android:11.0:-::::::
	cpe:2.3:o:google:android:12.0:-::::::
	cpe:2.3:o:google:android:12.1:-::::::
	cpe:2.3:o:google:android:13.0:-::::::

History

No history.

Information

Published : 2023-08-14 22:15

Updated : 2024-11-21 07:42

NVD link : CVE-2023-21287

Mitre link : CVE-2023-21287

CVE.ORG link : CVE-2023-21287

JSON object : View

Products Affected

google

android

CWE

CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

{"id": "CVE-2023-21287", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2023-08-14T22:15:13.663", "references": [{"url": "https://android.googlesource.com/platform/external/freetype/+/a79e80a25874dacaa266906a9048f13d4bac41c6", "tags": ["Patch"], "source": "security@android.com"}, {"url": "https://source.android.com/security/bulletin/2023-08-01", "tags": ["Patch", "Vendor Advisory"], "source": "security@android.com"}, {"url": "https://android.googlesource.com/platform/external/freetype/+/a79e80a25874dacaa266906a9048f13d4bac41c6", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://source.android.com/security/bulletin/2023-08-01", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-843"}]}], "descriptions": [{"lang": "en", "value": "In multiple locations, there is a possible code execution due to type confusion. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.\n\n"}], "lastModified": "2024-11-21T07:42:34.197", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:google:android:11.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F120D280-287A-474F-9DC5-CBBC4B4C7237"}, {"criteria": "cpe:2.3:o:google:android:12.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "16820CAF-0A8A-45C8-B5A8-979EA0407389"}, {"criteria": "cpe:2.3:o:google:android:12.1:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F3B54CC6-C4CB-4BBD-AADC-BC7A80F4F621"}, {"criteria": "cpe:2.3:o:google:android:13.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "08A26AC2-409E-499A-B0D5-8C2B5038947D"}], "operator": "OR"}]}], "sourceIdentifier": "security@android.com"}