CVE-2023-35679: Medium severity Google Android vulnerability

Published Sep 5, 2023

Updated

In MtpPropertyValue of MtpProperty.h, there is a possible out of bounds read due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.

Affected Software

5 affected components

Google Android=11.0

Google Android=12.0

Google Android=12.1

Google Android=13.0

Google Android

Event History

Sep 5, 2023

CVE Published

via Android·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityWeaknessAffected Software

Sep 11, 2023

CVE Published

via MITRE·08:09 PM

Data Sourced

via MITRE·08:09 PM

DescriptionWeakness

Frequently Asked Questions

What is CVE-2023-35679?

CVE-2023-35679 is a vulnerability in MtpPropertyValue of MtpProperty.h that can lead to local information disclosure.

How severe is CVE-2023-35679?

CVE-2023-35679 has a severity rating of high (5.5).

Who is affected by CVE-2023-35679?

Users of Google Android versions 11.0, 12.0, 12.1, and 13.0 are affected by CVE-2023-35679.

How can CVE-2023-35679 be exploited?

Exploiting CVE-2023-35679 requires user interaction.

Are there any references related to CVE-2023-35679?

Yes, you can find references related to CVE-2023-35679 at the following links: [Link 1](https://android.googlesource.com/platform/frameworks/av/+/ea6131efa76a0b2a12724ffd157909e2c6fb4036), [Link 2](https://source.android.com/security/bulletin/2023-09-01), [Link 3](https://source.android.com/docs/security/bulletin/2023-09-01).