CVE-2023-40104

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In ca-certificates, there is a possible way to read encrypted TLS data due to untrusted cryptographic certificates. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-295

Affected software

No affected versions have been published.

Timeline

Published
Feb 15, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2023

CVE-2023-401055.5In backupAgentCreated of ActivityManagerService.java, there is a possible way to leak sensitive data due to a missing permission check. ThisCVE-2023-401067.8In sanitizeSbn of NotificationManagerService.java, there is a possible way to launch an activity from the background due to BAL Bypass. ThisCVE-2023-401077.8In ARTPWriter of ARTPWriter.cpp, there is a possible use after free due to uninitialized data. This could lead to local escalation of privilCVE-2023-401085.5In multiple locations, there is a possible way to access media content belonging to another user due to a missing permission check. This couCVE-2023-401097.8In createFromParcel of UsbConfiguration.java, there is a possible background activity launch (BAL) due to a permissions bypass. This could lCVE-2023-40117.5An issue has been discovered in GitLab EE affecting all versions from 15.11 prior to 16.2.2 which allows an attacker to spike the resource cCVE-2023-401107.8In multiple functions of MtpPacket.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escaCVE-2023-401117.8In setMediaButtonReceiver of MediaSessionRecord.java, there is a possible way to send a pending intent on behalf of system_server due to a cCVE-2023-401125.5In ippSetValueTag of ipp.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclCVE-2023-401135.5In multiple locations, there is a possible way for apps to access cross-user message data due to a missing permission check. This could leadCVE-2023-401147.8In multiple functions of MtpFfsHandle.cpp , there is a possible out of bounds write due to a use after free. This could lead to local escalaCVE-2023-401157.8In readLogs of StatsService.cpp, there is a possible memory corruption due to a use after free. This could lead to local escalation of privi