medium5.5

CVE-2024-40656

In handleCreateConferenceComplete of ConnectionServiceWrapper.java, there is a possible way to reveal images across users due to a confused deputy.

Impact

In handleCreateConferenceComplete of ConnectionServiceWrapper.java, there is a possible way to reveal images across users due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.

Affected products

Vendor	Product	Affected versions
Google	Android	Versions 12.0, 12.1, 13.0, 14.0

Weakness classification

CWE-125

References

NVD record
CVE.org record
https://android.googlesource.com/platform/packages/services/Telecomm/+/f3e6a6c02439401eb7aeb3749ee5ec0b51a625b9
https://source.android.com/security/bulletin/2024-09-01