CVE-2024-0023 (High) detected in avandroid-10.0.0_r37
mend-bolt-for-github opened this issue · 0 comments
mend-bolt-for-github commented
CVE-2024-0023 - High Severity Vulnerability
Vulnerable Library - avandroid-10.0.0_r37
Library home page: https://android.googlesource.com/platform/frameworks/av
Found in HEAD commit: 3817576ceacd1f81d53c0f1b5eec2a5cbecff7c3
Found in base branch: master
Vulnerability Details
In ConvertRGBToPlanarYUV of Codec2BufferUtils.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Publish Date: 2024-02-16
URL: CVE-2024-0023
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Step up your Open Source Security Game with Mend here