Saturday , June 15 2024

Google Patches 46 Android Vulnerabilities, Including 3 Actively Exploited

Google has released its monthly security updates for the Android operating system, addressing 46 new software vulnerabilities. Three of these vulnerabilities have been identified as actively exploited in targeted attacks.

One vulnerability, tracked as CVE-2023-26083, is a memory leak flaw affecting the Arm Mali GPU driver for Bifrost, Avalon, and Valhall chips. This vulnerability was exploited in a previous attack that enabled spyware infiltration on Samsung devices in December 2022. The Cybersecurity and Infrastructure Security Agency (CISA) issued a patching order for federal agencies in April 2023 to address this vulnerability.

ASUS warn serious security vulnerability on 7 routers

ASUS released a new firmware update to fix a vulnerability affecting seven router models, which could be exploited by remote...
Read More
ASUS warn serious security vulnerability on 7 routers

AWS Announced New Malware Detection Tool For S3 Buckets

AWS announced new security features at its re:Inforce conference, such as identity and malware protection services. The cloud giant added...
Read More
AWS Announced New Malware Detection Tool For S3 Buckets

150,000 phones registered under one IMEI number in Bangladesh

A smartphone's IMEI (which stands for International Mobile Equipment Identity) is a unique identifier for each device, similar to a...
Read More
150,000 phones registered under one IMEI number in Bangladesh

CISA Releases Twenty Industrial Control Systems Advisories

CISA released 20 advisories about Industrial Control Systems (ICS) on June 13, 2024. These advisories give important information about security...
Read More
CISA Releases Twenty Industrial Control Systems Advisories

Current web vulnerabilities in Bangladesh across vendor product line

On a report titled "Surge on Web defacement and web application related vulnerabilities targeting Bangladesh" BGD e-GOV CIRT said, web...
Read More
Current web vulnerabilities in Bangladesh across vendor product line

Criminals impersonating CISA’s employees in phone calls

CISA warned that criminals are pretending to be its employees in phone calls in order to trick people into sending...
Read More
Criminals impersonating CISA’s employees in phone calls

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA added 2 new vulnerabilities to its catalog of known exploited vulnerabilities, because they have proof that these vulnerabilities are...
Read More
CISA Adds Two Known Exploited Vulnerabilities to Catalog

Microsoft Tuesday fixes 51 flaws, 18 RCEs June 2024 Patch

Microsoft has released updates for 49 security vulnerabilities in its Patch Tuesday update for June. One of the fixes addresses...
Read More
Microsoft Tuesday fixes 51 flaws, 18 RCEs June 2024 Patch

Hackers breached 20,000 FortiGate systems worldwide: MIVD

The Dutch military security service MIVD recently revealed that a cyber espionage campaign, which was initially mentioned in February, managed...
Read More
Hackers breached 20,000 FortiGate systems worldwide: MIVD

Riskiest Connected Devices in 2024: Forescout Report

By 2028, there will be over 25 billion Internet of Things (IoT) devices. Attackers are increasingly targeting various devices, operating systems,...
Read More
Riskiest Connected Devices in 2024: Forescout Report

ALSO READ:

BDSec CTF 2023 calling you, Registration opens

Another significant vulnerability, identified as CVE-2021-29256, affects specific versions of the Bifrost and Midgard Arm Mali GPU kernel drivers. This flaw allows an unprivileged user to gain unauthorized access to sensitive data and escalate privileges to the root level.

The third exploited vulnerability, CVE-2023-2136, is a critical-severity bug discovered in Skia, Google’s open-source multi-platform 2D graphics library. It was initially disclosed as a zero-day vulnerability in the Chrome browser and allows a remote attacker who has taken over the renderer process to perform a sandbox escape and implement remote code on Android devices.

In addition to these three vulnerabilities, Google’s July Android security bulletin highlights another critical vulnerability, CVE-2023-21250, affecting the Android System component. This issue can cause remote code execution without user interaction or additional execution privileges, making it particularly precarious.

The security updates are rolled out in two patch levels. The initial patch level, made available on July 1, focuses on core Android components, addressing 22 security defects in the Framework and System components.

The second patch level, released on July 5, targets kernel and closed source components, tackling 20 vulnerabilities in Kernel, Arm, Imagination Technologies, MediaTek, and Qualcomm components.

It is important to note that the impact of the addressed vulnerabilities may extend beyond the supported Android versions (11, 12, and 13), potentially affecting older OS versions that no longer receive official support.

Google has also released specific security patches for its Pixel devices, addressing 14 vulnerabilities in Kernel, Pixel, and Qualcomm components. Two of these critical weaknesses could result in privilege elevation and denial-of-service attacks.

Check Also

cisa

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA added 2 new vulnerabilities to its catalog of known exploited vulnerabilities, because they have …

Leave a Reply

Your email address will not be published. Required fields are marked *