by Kastro
Paper/Archive/CVE-2023-21287

CVE-2023-21287

Google Android — In multiple locations, there is a possible code execution due to type confusion.

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
38
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 43.3.433 × 208.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

In multiple locations, there is a possible code execution due to type confusion. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected

ProductAffectedFixed inSource
Android13–CNA
Android12L–CNA
Android12–CNA
Android11–CNA
admob11–CISA-ADP
admob12–CISA-ADP
admob12l–CISA-ADP
admob13–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refandroid.googlesource.com/platform/external/freetype/+/a79e80a25874dacaa266906a9048f13d4bac41c6refsource.android.com/security/bulletin/2023-08-01