CVE-2023-40138
First published: Mon Oct 02 2023(Updated: )
In FillUi of FillUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Credit: security@android.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Google Android | ||
| Google Android | =11.0 | |
| Google Android | =12.0 | |
| Google Android | =12.1 | |
| Google Android | =13.0 |
Remedy
https://android.googlesource.com/platform/frameworks/base/+/08becc8c600f14c5529115cc1a1e0c97cd503f33
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2023-40138.
What is the severity level of CVE-2023-40138?
CVE-2023-40138 has a severity level of high.
Which software is affected by CVE-2023-40138?
Google Android is affected by CVE-2023-40138.
Is user interaction required for the exploitation of CVE-2023-40138?
No, user interaction is not needed for the exploitation of CVE-2023-40138.
Where can I find more information about CVE-2023-40138?
You can find more information about CVE-2023-40138 at the following references: - [Link 1](https://android.googlesource.com/platform/frameworks/base/+/08becc8c600f14c5529115cc1a1e0c97cd503f33) - [Link 2](https://source.android.com/docs/security/bulletin/2023-10-01) - [Link 3](https://source.android.com/security/bulletin/2023-10-01)
- agent/type
- agent/remedy
- agent/softwarecombine
- agent/first-publish-date
- collector/nvd-api
- agent/software-canonical-lookup-request
- collector/android-source
- source/Android
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/severity
- agent/references
- agent/author
- agent/tags
- agent/description
- agent/event
- collector/mitre-cve
- source/MITRE
- vendor/google
- canonical/google android
- version/google android/11.0
- version/google android/12.0
- version/google android/12.1
- version/google android/13.0