CVE-2023-32848

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-32848", "assignerOrgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374", "state": "PUBLISHED", "assignerShortName": "MediaTek", "dateReserved": "2023-05-16T03:04:32.155Z", "datePublished": "2023-12-04T03:45:43.472Z", "dateUpdated": "2024-10-17T15:23:31.888Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374", "shortName": "MediaTek", "dateUpdated": "2023-12-04T03:45:43.472Z"}, "descriptions": [{"lang": "en", "value": "In vdec, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08163896; Issue ID: ALPS08163896."}], "affected": [{"vendor": "MediaTek, Inc.", "product": "MT6761, MT6763, MT6765, MT6768, MT6771, MT6779, MT6785, MT6853, MT6873, MT6885", "versions": [{"version": "Android 11.0, 12.0, 13.0", "status": "affected"}]}], "references": [{"url": "https://corp.mediatek.com/product-security-bulletin/December-2023"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "Elevation of Privilege"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T15:32:46.491Z"}, "title": "CVE Program Container", "references": [{"url": "https://corp.mediatek.com/product-security-bulletin/December-2023", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-787", "lang": "en", "description": "CWE-787 Out-of-bounds Write"}]}], "affected": [{"vendor": "mediatek", "product": "mt6885", "cpes": ["cpe:2.3:h:mediatek:mt6761:-:*:*:*:*:*:*:*", "cpe:2.3:h:mediatek:mt6763:-:*:*:*:*:*:*:*", "cpe:2.3:h:mediatek:mt6765:-:*:*:*:*:*:*:*", "cpe:2.3:h:mediatek:mt6768:-:*:*:*:*:*:*:*", "cpe:2.3:h:mediatek:mt6771:-:*:*:*:*:*:*:*", "cpe:2.3:h:mediatek:mt6779:-:*:*:*:*:*:*:*", "cpe:2.3:h:mediatek:mt6785:-:*:*:*:*:*:*:*", "cpe:2.3:h:mediatek:mt6853:-:*:*:*:*:*:*:*", "cpe:2.3:h:mediatek:mt6873:-:*:*:*:*:*:*:*", "cpe:2.3:h:mediatek:mt6885:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "Android 11.0", "status": "affected"}, {"version": "Android 12.0", "status": "affected"}, {"version": "Android 13.0", "status": "affected"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-10-15T17:15:04.784061Z", "id": "CVE-2023-32848", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-17T15:23:31.888Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://corp.mediatek.com/product-security-bulletin/December-2023", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T15:32:46.491Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2023-32848", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-10-15T17:15:04.784061Z"}}}], "affected": [{"cpes": ["cpe:2.3:h:mediatek:mt6761:-:*:*:*:*:*:*:*", "cpe:2.3:h:mediatek:mt6763:-:*:*:*:*:*:*:*", "cpe:2.3:h:mediatek:mt6765:-:*:*:*:*:*:*:*", "cpe:2.3:h:mediatek:mt6768:-:*:*:*:*:*:*:*", "cpe:2.3:h:mediatek:mt6771:-:*:*:*:*:*:*:*", "cpe:2.3:h:mediatek:mt6779:-:*:*:*:*:*:*:*", "cpe:2.3:h:mediatek:mt6785:-:*:*:*:*:*:*:*", "cpe:2.3:h:mediatek:mt6853:-:*:*:*:*:*:*:*", "cpe:2.3:h:mediatek:mt6873:-:*:*:*:*:*:*:*", "cpe:2.3:h:mediatek:mt6885:-:*:*:*:*:*:*:*"], "vendor": "mediatek", "product": "mt6885", "versions": [{"status": "affected", "version": "Android 11.0"}, {"status": "affected", "version": "Android 12.0"}, {"status": "affected", "version": "Android 13.0"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-17T15:23:23.173Z"}}], "cna": {"affected": [{"vendor": "MediaTek, Inc.", "product": "MT6761, MT6763, MT6765, MT6768, MT6771, MT6779, MT6785, MT6853, MT6873, MT6885", "versions": [{"status": "affected", "version": "Android 11.0, 12.0, 13.0"}]}], "references": [{"url": "https://corp.mediatek.com/product-security-bulletin/December-2023"}], "descriptions": [{"lang": "en", "value": "In vdec, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08163896; Issue ID: ALPS08163896."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "Elevation of Privilege"}]}], "providerMetadata": {"orgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374", "shortName": "MediaTek", "dateUpdated": "2023-12-04T03:45:43.472Z"}}}, "cveMetadata": {"cveId": "CVE-2023-32848", "state": "PUBLISHED", "dateUpdated": "2024-10-17T15:23:31.888Z", "dateReserved": "2023-05-16T03:04:32.155Z", "assignerOrgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374", "datePublished": "2023-12-04T03:45:43.472Z", "assignerShortName": "MediaTek"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "MT6761, MT6763, MT6765, MT6768, MT6771, MT6779, MT6785, MT6853, MT6873, MT6885", "vendor": "MediaTek, Inc.", "versions": [{"status": "affected", "version": "Android 11.0, 12.0, 13.0"}]}], "source": "security@mediatek.com"}, {"affectedData": [{"cpes": ["cpe:2.3:h:mediatek:mt6761:-:*:*:*:*:*:*:*", "cpe:2.3:h:mediatek:mt6763:-:*:*:*:*:*:*:*", "cpe:2.3:h:mediatek:mt6765:-:*:*:*:*:*:*:*", "cpe:2.3:h:mediatek:mt6768:-:*:*:*:*:*:*:*", "cpe:2.3:h:mediatek:mt6771:-:*:*:*:*:*:*:*", "cpe:2.3:h:mediatek:mt6779:-:*:*:*:*:*:*:*", "cpe:2.3:h:mediatek:mt6785:-:*:*:*:*:*:*:*", "cpe:2.3:h:mediatek:mt6853:-:*:*:*:*:*:*:*", "cpe:2.3:h:mediatek:mt6873:-:*:*:*:*:*:*:*", "cpe:2.3:h:mediatek:mt6885:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "mt6885", "vendor": "mediatek", "versions": [{"status": "affected", "version": "Android 11.0"}, {"status": "affected", "version": "Android 12.0"}, {"status": "affected", "version": "Android 13.0"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:google:android:11.0:-:*:*:*:*:*:*", "matchCriteriaId": "F120D280-287A-474F-9DC5-CBBC4B4C7237", "vulnerable": true}, {"criteria": "cpe:2.3:o:google:android:12.0:-:*:*:*:*:*:*", "matchCriteriaId": "16820CAF-0A8A-45C8-B5A8-979EA0407389", "vulnerable": true}, {"criteria": "cpe:2.3:o:google:android:13.0:-:*:*:*:*:*:*", "matchCriteriaId": "08A26AC2-409E-499A-B0D5-8C2B5038947D", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:mediatek:mt6761:-:*:*:*:*:*:*:*", "matchCriteriaId": "F726F486-A86F-4215-AD93-7A07A071844A", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt6763:-:*:*:*:*:*:*:*", "matchCriteriaId": "2F19C76A-50DF-4ACA-BACA-07157B4D838B", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt6765:-:*:*:*:*:*:*:*", "matchCriteriaId": "43E779F6-F0A0-4153-9A1D-B715C3A2F80E", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt6768:-:*:*:*:*:*:*:*", "matchCriteriaId": "06CD97E1-8A76-48B4-9780-9698EF5A960F", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt6771:-:*:*:*:*:*:*:*", "matchCriteriaId": "BE4D2AED-C713-407F-A34A-52C3D8F65835", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt6779:-:*:*:*:*:*:*:*", "matchCriteriaId": "EBA369B8-8E23-492B-82CC-23114E6A5D1C", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt6785:-:*:*:*:*:*:*:*", "matchCriteriaId": "A82E0A4F-072F-474C-B94C-8114ABE05639", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt6853:-:*:*:*:*:*:*:*", "matchCriteriaId": "366F1912-756B-443E-9962-224937DD7DFB", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt6873:-:*:*:*:*:*:*:*", "matchCriteriaId": "F6B8A36E-C5FB-44AE-A1C3-50EBF4C68F6B", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt6885:-:*:*:*:*:*:*:*", "matchCriteriaId": "DD64413C-C774-4C4F-9551-89E1AA9469EE", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In vdec, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08163896; Issue ID: ALPS08163896."}, {"lang": "es", "value": "En vdec, existe una posible escritura fuera de los l\u00edmites debido a confusi\u00f3n de tipos. Esto podr\u00eda conducir a una escalada local de privilegios con permisos de ejecuci\u00f3n de System necesarios. La interacci\u00f3n del usuario no es necesaria para la explotaci\u00f3n. ID de parche: ALPS08163896; ID del problema: ALPS08163896."}], "id": "CVE-2023-32848", "lastModified": "2026-06-17T05:59:46.547", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-32848", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-10-15T17:15:04.784061Z", "version": "2.0.3"}}]}, "published": "2023-12-04T04:15:07.710", "references": [{"source": "security@mediatek.com", "tags": ["Vendor Advisory"], "url": "https://corp.mediatek.com/product-security-bulletin/December-2023"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://corp.mediatek.com/product-security-bulletin/December-2023"}], "sourceIdentifier": "security@mediatek.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-787"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{}