CVE-2023-21233

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In multiple locations of avrc, there is a possible leak of heap data due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-908

Affected software

No affected versions have been published.

Timeline

Published
Aug 14, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-212345.5In launchConfirmationActivity of ChooseLockSettingsHelper.java, there is a possible way to enable developer options without the lockscreen PCVE-2023-212357.8In onCreate of LockSettingsActivity.java, there is a possible way set a new lockscreen PIN without entering the existing PIN due to a permisCVE-2023-212366.7In aoc_service_set_read_blocked of aoc.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local esCVE-2023-212375.5In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification due to misleading orCVE-2023-212385.5In visitUris of RemoteViews.java, there is a possible leak of images between users due to a confused deputy. This could lead to local informCVE-2023-212395.5In visitUris of Notification.java, there is a possible way to leak image data across user boundaries due to a confused deputy. This could leCVE-2023-21247.8An out-of-bounds memory access flaw was found in the Linux kernel’s XFS file system in how a user restores an XFS image after failure (with CVE-2023-212405.5In Policy of Policy.java, there is a possible boot loop due to resource exhaustion. This could lead to local denial of service with no additCVE-2023-212417.8In rw_i93_send_to_upper of rw_i93.cc, there is a possible out of bounds write due to an integer overflow. This could lead to local escalatioCVE-2023-212429.8In isServerCertChainValid of InsecureEapNetworkHandler.java, there is a possible way to trust an imposter server due to a logic error in theCVE-2023-212435.5In validateForCommonR1andR2 of PasspointConfiguration.java, there is a possible way to inflate the size of a config file with no limits due CVE-2023-212446.7In visitUris of Notification.java, there is a possible bypass of user profile boundaries due to a missing permission check. This could lead
CVE-2023-21233: High severity, CVSS 7.5 | Vulnix