PT-2023-29121 · Google · Com.Android.Server.Telecom

Published 2023-09-27 · Updated 2023-10-02 · CVE-2023-44127

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions com.android.server.telecom (affected versions not specified)

Description The issue is related to the Call management app patched by LG, which launches implicit intents that disclose sensitive data to all third-party apps installed on the same device. This sensitive data includes contact details and phone numbers.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-927

Related Identifiers

CVE-2023-44127

Affected Products

Com.Android.Server.Telecom

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-44127 · Security Note
• https://osv.dev/vulnerability/CVE-2023-44127 · Vendor Advisory
• https://lgsecurity.lge.com/bulletins/mobile#updateDetails · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1707087833305936026 · Twitter Post
• https://twitter.com/CVEnew/status/1707040063962419553 · Twitter Post
• https://t.me/cibsecurity/71079 · Telegram Post