CVE-2023-40093: Medium severity Google Android vulnerability
In multiple files, there is a possible way that trimmed content could be included in PDF output due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/ctsto a version that resolves this vulnerability.Fixed in 14-next:2024-02-01 - Upgrade
Upgrade
android/platform/external/pdfiumto a version that resolves this vulnerability.Fixed in 14-next:2024-02-01 - Upgrade
Upgrade
android/platform/ctsto a version that resolves this vulnerability.Fixed in 11:2024-02-01 - Upgrade
Upgrade
android/platform/external/pdfiumto a version that resolves this vulnerability.Fixed in 11:2024-02-01 - Upgrade
Upgrade
android/platform/ctsto a version that resolves this vulnerability.Fixed in 12:2024-02-01 - Upgrade
Upgrade
android/platform/external/pdfiumto a version that resolves this vulnerability.Fixed in 12:2024-02-01 - Upgrade
Upgrade
android/platform/ctsto a version that resolves this vulnerability.Fixed in 12L:2024-02-01 - Upgrade
Upgrade
android/platform/external/pdfiumto a version that resolves this vulnerability.Fixed in 12L:2024-02-01 - Upgrade
Upgrade
android/platform/ctsto a version that resolves this vulnerability.Fixed in 13:2024-02-01 - Upgrade
Upgrade
android/platform/external/pdfiumto a version that resolves this vulnerability.Fixed in 13:2024-02-01 - Upgrade
Upgrade
android/platform/ctsto a version that resolves this vulnerability.Fixed in 14:2024-02-01 - Upgrade
Upgrade
android/platform/external/pdfiumto a version that resolves this vulnerability.Fixed in 14:2024-02-01
Event History
Frequently Asked Questions
What is the severity of CVE-2023-40093?
CVE-2023-40093 is rated as a moderate severity vulnerability due to its potential for local information disclosure.
How do I fix CVE-2023-40093?
To mitigate CVE-2023-40093, users should update their Android devices to the latest security patch provided by Google.
What are the affected versions in CVE-2023-40093?
CVE-2023-40093 affects Android versions 11.0 through 14.0.
Is user interaction needed to exploit CVE-2023-40093?
No, CVE-2023-40093 can be exploited without any user interaction.
What type of vulnerability is CVE-2023-40093?
CVE-2023-40093 is a logic error vulnerability that can lead to local information disclosure.