CVE-2023-35675: Medium severity Google Android vulnerability

Published Sep 5, 2023

Updated

In loadMediaResumptionControls of MediaResumeListener.kt, there is a possible way to play and listen to media files played by another user on the same device due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected Software

5 affected components

Google Android=11.0

Google Android=12.0

Google Android=12.1

Google Android=13.0

Google Android

Event History

Sep 5, 2023

CVE Published

via Android·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityWeaknessAffected Software

Sep 11, 2023

CVE Published

via MITRE·08:09 PM

Data Sourced

via MITRE·08:09 PM

DescriptionWeakness

Frequently Asked Questions

What is CVE-2023-35675?

CVE-2023-35675 is a vulnerability in the loadMediaResumptionControls function of MediaResumeListener.kt in Android that allows an attacker to play and listen to media files played by another user on the same device, potentially leading to local information disclosure.

What is the severity of CVE-2023-35675?

The severity of CVE-2023-35675 is high with a CVSS score of 5.5.

Which software is affected by CVE-2023-35675?

CVE-2023-35675 affects Google Android versions 11.0, 12.0, 12.1, and 13.0.

Are user interactions required to exploit CVE-2023-35675?

No, additional execution privileges are not needed, and user interactions are not required to exploit CVE-2023-35675.

How can I mitigate CVE-2023-35675?

To mitigate CVE-2023-35675, it is recommended to apply the patches provided by Google and update to the latest version of Android.