Weekly Vulnerabilities Reports > May 6 to 12, 2024

An improper certificate validation vulnerability exists in BIG-IP Next Central Manager and may allow an attacker to impersonate an Instance Provider system.

In multiple methods of UserManagerService.java, there is a possible failure to persist or enforce user restrictions due to improper input validation.

In sendIntentSender of ActivityManagerService.java, there is a possible background activity launch due to a logic error.

In TBD of TBD, there is a possible confusion of OEM and DRM certificates due to improperly used crypto.

In multiple locations, there is a possible notification listener grant to an app running in the work profile due to a logic error in the code.

In onCreate of WifiDialogActivity.java, there is a possible way to bypass the DISALLOW_ADD_WIFI_CONFIG restriction due to a missing permission check.

In multiple locations, there is a possible failure to persist or enforce user restrictions due to improper input validation.

In multiple locations, there is a possible bypass of health data permissions due to an improper input validation.

In multiple locations, there is a possible permissions bypass due to improper input validation.

In multiple functions of NotificationManagerService.java, there is a possible way to not show a toast message when a clipboard message has been accessed.

In assertPackageWithSharedUserIdIsPrivileged of InstallPackageHelper.java, there is a possible execution of arbitrary app code as a privileged app due to a logic error in the code.

In migrateNotificationFilter of NotificationManagerService.java, there is a possible failure to persist notifications settings due to improper input validation.

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine.

BIG-IP Next Central Manager (CM) may allow an unauthenticated, remote attacker to obtain the BIG-IP Next LTM/WAF instance credentials.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine.

In multiple locations, there is a possible out of bounds write due to a heap buffer overflow.

Heap buffer overflow in WebAudio in Google Chrome prior to 124.0.6367.155 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

In multiple functions of CompanionDeviceManagerService.java, there is a possible launch NotificationAccessConfirmationActivity of another user profile due to improper input validation.

In multiple functions of SnoozeHelper.java, there is a possible persistent denial of service due to resource exhaustion.

In multiple functions of SnoozeHelper.java, there is a possible way to cause a boot loop due to resource exhaustion.

In multiple functions of AppOpsService.java, there is a possible way to saturate the content of /data/system/appops_accesses.xml due to resource exhaustion.

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine.