InfoSecBulletin Cybersecurity for mankind
Google has released patches for 47 security flaws in Android, including one that is actively being exploited. CVE-2024-53104 (CVSS score: 7.8) is a vulnerability that allows privilege escalation in the USB Video Class (UVC) driver kernel component.
Successful exploitation of the flaw could lead to physical escalation of privilege, Google said, noting that it’s aware that it may be under “limited, targeted exploitation.”
CVE-2025-24201
Apple fixes 0-day exploited in “extremely sophisticated attack”
Microsoft’s March 2025 updates fix 7 zero-day, 57 flaws
Ballista Botnet infects 6000 Unpatched TP-Link Routers
CVE-2025-24813
Flaw in Apache Tomcat Exposes Servers to RCE
CISA Adds 3 Ivanti Endpoint Manager Bugs to KEV
Ransomware Attacks Set Records in February: New Data Shows
Cyber attack at Japanese telecom leader NTT hits 18,000 companies
Cyber heist: Pune losses Rs 6007 crore in cyber scam
Nearly 1 million airport lost and found records leaked
Exploiting CVE-2024-4577, Attackers Target Japan with Cobalt Strike
The specific details about the vulnerability have not been shared, but Linux kernel developer Greg Kroah-Hartman mentioned in early December 2024 that it originates in the Linux kernel, first appearing in version 2.6.26, released in mid-2008.
Specifically, it has to do with an out-of-bounds write condition that could arise as a result of parsing frames of type UVC_VS_UNDEFINED in a function named “uvc_parse_format()” in the “uvc_driver.c” program.
This flaw could lead to memory corruption, program crashes, or unauthorized code execution.
It’s unclear who is exploiting the vulnerability, but GrapheneOS suggests it could be misused by forensic data extraction tools for physical privilege escalation.
Google’s monthly security updates also fixed a critical flaw in Qualcomm’s WLAN component (CVE-2024-45569, CVSS score: 9.8) that could cause memory corruption.
Google has released two security patch levels, 2025-02-01 and 2025-02-05, to help Android partners quickly address similar vulnerabilities across devices.
“Android partners are encouraged to fix all issues in this bulletin and use the latest security patch level,” Google said.
