CVE-2023-45779

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In the APEX module framework of AOSP, there is a possible malicious update to platform components due to improperly used crypto. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. More details on this can be found in the referenced links.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
Google	Android	Android SoC

References

Timeline

Published: Dec 4, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-45786.5When calling `JS::CheckRegExpSyntax` a Syntax Error could have been set which would end in calling `convertToRuntimeErrorAndClear`. A path i CVE-2023-457807.3In Print Service, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of pr CVE-2023-457815.5In parse_gap_data of utils.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information di CVE-2023-45793.1Search queries in the default search engine could appear to have been the currently navigated URL if the search query itself was a well form CVE-2023-457935.5A vulnerability has been identified in Siveillance Control (All versions >= V2.8 < V3.1.1). The affected product does not properly check the CVE-2023-457948.1A vulnerability has been identified in Mendix Applications using Mendix 10 (All versions < V10.4.0), Mendix Applications using Mendix 7 (All CVE-2023-457957.8A cross-site scripting vulnerability in the Builder Component of Pilz PASvisu before 1.14.1 allows a local unauthenticated attacker to injec CVE-2023-457968.1A stored cross-site scripting vulnerability in the Runtime component of Pilz PASvisu before 1.14.1 and PMI v8xx up to and including 2.0.3399 CVE-2023-457979.8A Buffer overflow vulnerability in DreamSecurity MagicLine4NX versions 1.0.0.1 to 1.0.0.26 allows an attacker to remotely execute code.CVE-2023-457989.8In Yettiesoft VestCert versions 2.36 to 2.5.29, a vulnerability exists due to improper validation of third-party modules. This allows malici CVE-2023-457999.8In MLSoft TCO!stream versions 8.0.22.1115 and below, a vulnerability exists due to insufficient permission validation. This allows an attack CVE-2023-45806.5Push notifications stored on disk in private browsing mode were not being encrypted potentially allowing the leak of sensitive information.