PT-2022-6987 · Unknown · Keyinstall

Published 2022-10-28 · Updated 2023-08-09 · CVE-2023-20780

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions keyinstall (affected versions not specified)

Description The issue is related to a missing bounds check in keyinstall, which could lead to local information disclosure. System execution privileges are needed for exploitation, and user interaction is not required. The vulnerability is associated with insufficient protection of service data due to incorrect input validation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

RCE

Weakness Enumeration

CWE-200

CWE-20

Related Identifiers

ASB-A-285686353

BDU:2023-06153

CVE-2023-20780

M-ALPS08017756

Affected Products

Keyinstall

References · 7

• https://bdu.fstec.ru/vul/2023-06153 · Security Note
• https://corp.mediatek.com/product-security-bulletin/August-2023 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-20780 · Security Note
• https://osv.dev/vulnerability/CVE-2023-20780 · Vendor Advisory
• https://vuldb.com/?id.236243 · Note
• https://source.android.com/docs/security/bulletin/2023-08-01?hl=ru · Note
• https://t.me/cvenotify/55914 · Telegram Post