CVE-2023-35692

HIGH Year: 2023
CVSS v3 Score
7.8
High
Weakness Type
CWE-273
View all →

Vulnerability Description

In getLocationCache of GeoLocation.java, there is a possible way to send a mock location during an emergency call due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Related Vulnerabilities

CVE-2006-2916

HIGH
CVSS:7.8(High)

artswrapper in aRts, when running setuid root on Linux 2.6.0 or later versions, does not check the return value of the setuid function call, which allows local users to gain root privileges by causing...

CWE-2732006

CVE-2018-8599

HIGH
CVSS:7.8(High)

An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector Service improperly impersonates certain file operations, aka "Diagnostics Hub Standard Collector Service Elev...

CWE-2732018

CVE-2019-18276

HIGH
CVSS:7.8(High)

An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by settin...

CWE-2732019

CVE-2019-20044

HIGH
CVSS:7.8(High)

In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED option. Zsh fails to overwrite the saved uid, so the original privileges can be restored by e...

CWE-2732019

CVE-2022-0358

HIGH
CVSS:7.8(High)

A flaw was found in the QEMU virtio-fs shared file system daemon (virtiofsd) implementation. This flaw is strictly related to CVE-2018-13405. A local guest user can create files in the directories sha...

CWE-2732022

CVE-2023-34322

HIGH
CVSS:7.8(High)

For migration as well as to work around kernels unaware of L1TF (see XSA-273), PV guests may be run in shadow paging mode. Since Xen itself needs to be mapped when PV guests run, Xen and shadowed PV g...

CWE-2732023