CVE-2023-40137
First published: Mon Oct 02 2023(Updated: )
In multiple functions of DialogFillUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Credit: security@android.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Google Android | ||
| Google Android | =11.0 | |
| Google Android | =12.0 | |
| Google Android | =12.1 | |
| Google Android | =13.0 |
Remedy
https://android.googlesource.com/platform/frameworks/base/+/08becc8c600f14c5529115cc1a1e0c97cd503f33
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-40137.
What is the title of the vulnerability?
The title of the vulnerability is 'In multiple functions of DialogFillUi.java there is a possible way to view another user's images due...'
What is the severity of CVE-2023-40137?
The severity of CVE-2023-40137 is high.
How does CVE-2023-40137 impact Google Android?
CVE-2023-40137 can lead to local information disclosure on Google Android.
Is user interaction required to exploit CVE-2023-40137?
No, user interaction is not needed for exploitation of CVE-2023-40137.
- agent/type
- agent/remedy
- agent/softwarecombine
- agent/first-publish-date
- collector/nvd-api
- agent/software-canonical-lookup-request
- collector/android-source
- source/Android
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/severity
- agent/references
- agent/author
- agent/tags
- agent/description
- agent/event
- collector/mitre-cve
- source/MITRE
- vendor/google
- canonical/google android
- version/google android/11.0
- version/google android/12.0
- version/google android/12.1
- version/google android/13.0