deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-2329
Published: 2024-03-09
Description: A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/list_resource_icon.php?action=delete. The manipulation of the argument IconId leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-256280. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/flyyue2001/cve/blob/main/NS-ASG-sql-list_resource_icon.md; https://vuldb.com/?ctiid.256280; https://vuldb.com/?id.256280
CVE: CVE-2024-2330
Published: 2024-03-09
Description: A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been classified as critical. This affects an unknown part of the file /protocol/index.php. The manipulation of the argument IPAddr leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-256281 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/jikedaodao/cve/blob/main/NS-ASG-sql-addmacbind.md; https://vuldb.com/?ctiid.256281; https://vuldb.com/?id.256281
CVE: CVE-2024-1870
Published: 2024-03-09
Description: The Colibri Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the callActivateLicenseEndpoint function in all versions up to, and including, 1.0.260. This makes it possible for authenticated attackers, with subscriber access or higher, to update the license key.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/browser/colibri-page-builder/trunk/src/License/ActivationForm.php#L356; https://plugins.trac.wordpress.org/changeset/3045582/colibri-page-builder/trunk/src/License/ActivationForm.php?contextall=1&old=2888093&old_path=%2Fcolibri-page-builder%2Ftrunk%2Fsrc%2FLicense%2FActivationForm.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/130637ce-d70a-4831-8b88-a2a6e8a95c42?source=cve
CVE: CVE-2024-2331
Published: 2024-03-09
Description: A vulnerability was found in SourceCodester Tourist Reservation System 1.0. It has been declared as critical. This vulnerability affects the function ad_writedata of the file System.cpp. The manipulation of the argument ad_code leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-256282 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-120
References: https://github.com/wkeyi0x1/vul-report/blob/main/Tourist%20Reservation%20System%20using%20C%2B%2B%20with%20Free%20Source%20Code/buffer-overflow-1.md; https://vuldb.com/?ctiid.256282; https://vuldb.com/?id.256282
CVE: CVE-2024-2332
Published: 2024-03-09
Description: A vulnerability was found in SourceCodester Online Mobile Management Store 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/maintenance/manage_category.php of the component HTTP GET Request Handler. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256283.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/vanitashtml/CVE-Dumps/blob/main/Blind%20SQL%20Injection%20Manage%20Category%20-%20Mobile%20Management%20Store.md; https://vuldb.com/?ctiid.256283; https://vuldb.com/?id.256283
CVE: CVE-2024-2333
Published: 2024-03-09
Description: A vulnerability classified as critical has been found in CodeAstro Membership Management System 1.0. Affected is an unknown function of the file /add_members.php. The manipulation of the argument fullname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-256284.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/0x404Ming/CVE_Hunter/blob/main/SQLi-3.md; https://vuldb.com/?ctiid.256284; https://vuldb.com/?id.256284
CVE: CVE-2024-27698
Published: 2024-03-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2024-2351
Published: 2024-03-09
Description: A vulnerability classified as critical was found in CodeAstro Ecommerce Site 1.0. Affected by this vulnerability is an unknown functionality of the file action.php of the component Search. The manipulation of the argument cat_id/brand_id/keyword leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256303.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://docs.qq.com/doc/DYklCV0thWnRaaWpY; https://vuldb.com/?ctiid.256303; https://vuldb.com/?id.256303
CVE: CVE-2024-2352
Published: 2024-03-10
Description: A vulnerability, which was classified as critical, has been found in 1Panel up to 1.10.1-lts. Affected by this issue is the function baseApi.UpdateDeviceSwap of the file /api/v1/toolbox/device/update/swap. The manipulation of the argument Path with the input 123123123\nopen -a Calculator leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-256304.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77
References: https://github.com/1Panel-dev/1Panel/pull/4131; https://github.com/1Panel-dev/1Panel/pull/4131#issue[PII_REDACTED]; https://github.com/1Panel-dev/1Panel/pull/4131/commits/0edd7a9f6f5100aab98a0ea6e5deedff7700396c
CVE: CVE-2024-28757
Published: 2024-03-10
Description: libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).
CVSS Score: 7.5 (HIGH)
CWE: CWE-776, CWE-776
References: http://www.openwall.com/lists/oss-security/2024/03/15/1; https://github.com/libexpat/libexpat/issues/839; https://github.com/libexpat/libexpat/pull/842
CVE: CVE-2024-2353
Published: 2024-03-10
Description: A vulnerability, which was classified as critical, has been found in Totolink X6000R 9.4.0cu.852_20230719. This issue affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component shttpd. The manipulation of the argument ip leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-256313 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/OraclePi/repo/blob/main/totolink%20X6000R/1/X6000R%20AX3000%20WiFi%206%20Giga%20unauthed%20rce.md; https://vuldb.com/?ctiid.256313; https://vuldb.com/?id.256313
CVE: CVE-2024-2354
Published: 2024-03-10
Description: A vulnerability, which was classified as problematic, was found in Dreamer CMS 4.1.3. Affected is an unknown function of the file /admin/menu/toEdit. The manipulation of the argument id leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-256314 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/sweatxi/BugHub/blob/main/dreamer_cms_admin_menu_toEdit_csrf.pdf; https://vuldb.com/?ctiid.256314; https://vuldb.com/?id.256314
CVE: CVE-2024-2355
Published: 2024-03-10
Description: A vulnerability has been found in keerti1924 Secret-Coder-PHP-Project 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /secret_coder.sql. The manipulation leads to inclusion of sensitive information in source code. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256315. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.7 (LOW)
CWE: CWE-540
References: https://github.com/smurf-reigz/security/blob/main/proof-of-concepts/keerti1924%20%5BSecret-Coder-PHP-Project%20Sensitive%20Information%20Disclosure%5D%20on%20secret_coder.sql.md; https://vuldb.com/?ctiid.256315; https://vuldb.com/?id.256315
CVE: CVE-2024-2313
Published: 2024-03-10
Description: If kernel headers need to be extracted, bpftrace will attempt to load them from a temporary directory. An unprivileged attacker could use this to force bcc to load compromised linux headers. Linux distributions which provide kernel headers by default are not affected by default.
CVSS Score: 2.8 (LOW)
CWE: CWE-377
References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2313; https://github.com/bpftrace/bpftrace/commit/4be4b7191acb8218240e6b7178c30fa8c9b59998; https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2313
CVE: CVE-2024-2314
Published: 2024-03-10
Description: If kernel headers need to be extracted, bcc will attempt to load them from a temporary directory. An unprivileged attacker could use this to force bcc to load compromised linux headers. Linux distributions which provide kernel headers by default are not affected by default.
CVSS Score: 2.8 (LOW)
References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2314; https://github.com/iovisor/bcc/commit/008ea09e891194c072f2a9305a3c872a241dc342; https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2314
CVE: CVE-2024-2363
Published: 2024-03-10
Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in AOL AIM Triton 1.0.4. It has been declared as problematic. This vulnerability affects unknown code of the component Invite Handler. The manipulation of the argument CSeq leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-256318 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-404
References: https://fitoxs.com/vuldb/exploit/exploit_aim_triton.txt; https://vuldb.com/?ctiid.256318; https://vuldb.com/?id.256318
CVE: CVE-2024-2364
Published: 2024-03-10
Description: A vulnerability classified as problematic has been found in Musicshelf 1.0/1.1 on Android. Affected is an unknown function of the file androidmanifest.xml of the component Backup Handler. The manipulation leads to exposure of backup file to an unauthorized control sphere. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-256320.
CVSS Score: 1.8 (LOW)
CWE: CWE-530, CWE-552
References: https://github.com/ctflearner/Android_Findings/blob/main/Musicshelf/Musicshelf_Manifest_issue.md; https://vuldb.com/?ctiid.256320; https://vuldb.com/?id.256320
CVE: CVE-2024-2365
Published: 2024-03-11
Description: A vulnerability classified as problematic was found in Musicshelf 1.0/1.1 on Android. Affected by this vulnerability is an unknown functionality of the file io\fabric\sdk\android\services\network\PinningTrustManager.java of the component SHA-1 Handler. The manipulation leads to password hash with insufficient computational effort. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-256321 was assigned to this vulnerability.
CVSS Score: 1.6 (LOW)
CWE: CWE-916
References: https://github.com/ctflearner/Android_Findings/blob/main/Musicshelf/Weak_Hashing_Algorithms.md; https://vuldb.com/?ctiid.256321; https://vuldb.com/?id.256321
CVE: CVE-2024-2184
Published: 2024-03-11
Description: Buffer overflow in identifier field of WSD probe request process of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*:Satera MF740C Series/Satera MF640C Series/Satera LBP660C Series/Satera LBP620C Series firmware v12.07 and earlier, and Satera MF750C Series/Satera LBP670C Series firmware v03.09 and earlier sold in Japan.Color imageCLASS MF740C Series/Color imageCLASS MF640C Series/Color imageCLASS X MF1127C/Color imageCLASS LBP664Cdw/Color imageCLASS LBP622Cdw/Color imageCLASS X LBP1127C firmware v12.07 and earlier, and Color imageCLASS MF750C Series/Color imageCLASS X MF1333C/Color imageCLASS LBP674Cdw/Color imageCLASS X LBP1333C firmware v03.09 and earlier sold in US.i-SENSYS MF740C Series/i-SENSYS MF640C Series/C1127i Series/i-SENSYS LBP660C Series/i-SENSYS LBP620C Series/C1127P firmware v12.07 and earlier, and i-SENSYS MF750C Series/C1333i Series/i-SENSYS LBP673Cdw/C1333P firmware v03.09 and earlier sold in Europe.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://psirt.canon/advisory-information/cp2024-002/; https://psirt.canon/advisory-information/cp2024-002/
CVE: CVE-2024-28816
Published: 2024-03-11
Description: Student Information Chatbot a0196ab allows SQL injection via the username to the login function in index.php.
CVSS Score: 7.1 (HIGH)
CWE: CWE-89
References: https://github.com/AaravRajSIngh/Chatbot/pull/10; https://github.com/AaravRajSIngh/Chatbot/pull/10
CVE: CVE-2024-28823
Published: 2024-03-11
Description: Amazon AWS aws-js-s3-explorer (aka AWS JavaScript S3 Explorer) 1.0.0 allows XSS via a crafted S3 bucket name to index.html.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/awslabs/aws-js-s3-explorer/commit/f62f12960d081895960d0dc6fde8364f25d651b6; https://github.com/awslabs/aws-js-s3-explorer/issues/118; https://github.com/awslabs/aws-js-s3-explorer/commit/f62f12960d081895960d0dc6fde8364f25d651b6
CVE: CVE-2024-1373
Published: 2024-03-11
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-46209. Reason: This candidate is a duplicate of CVE-2023-46209. Notes: All CVE users should reference CVE-2023-46209 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2024-2370
Published: 2024-03-11
Description: Rejected reason: DO NOT USE THIS CVE ID NUMBER. Consult IDs: CVE-2018-5341. Reason: This CVE Record is a duplicate of CVE-2018-5341. Notes: All CVE users should reference CVE-2018-5341 instead of this record.
CVE: CVE-2024-1441
Published: 2024-03-11
Description: An off-by-one error flaw was found in the udevListInterfacesByStatus() function in libvirt when the number of interfaces exceeds the size of the `names` array. This issue can be reproduced by sending specially crafted data to the libvirt daemon, allowing an unprivileged client to perform a denial of service attack by causing the libvirt daemon to crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-193
References: https://access.redhat.com/errata/RHSA-2024:2560; https://access.redhat.com/security/cve/CVE-2024-1441; https://bugzilla.redhat.com/show_bug.cgi?id=2263841
CVE: CVE-2024-0670
Published: 2024-03-11
Description: Privilege escalation in windows agent plugin in Checkmk before 2.2.0p23, 2.1.0p40 and 2.0.0 (EOL) allows local user to escalate privileges
CVSS Score: 8.8 (HIGH)
CWE: CWE-427, CWE-427
References: http://seclists.org/fulldisclosure/2024/Mar/29; https://checkmk.com/werk/16361; http://seclists.org/fulldisclosure/2024/Mar/29
CVE: CVE-2024-23608
Published: 2024-03-11
Description: An out of bounds write due to a missing bounds check in LabVIEW may result in remote code execution.  Successful exploitation requires an attacker to provide a user with a specially crafted VI.  This vulnerability affects LabVIEW 2024 Q1 and prior versions.

CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/out-of-bounds-write-due-to-missing-bounds-check-in-labview.html; https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/out-of-bounds-write-due-to-missing-bounds-check-in-labview.html
CVE: CVE-2024-23609
Published: 2024-03-11
Description: An improper error handling vulnerability in LabVIEW may result in remote code execution.  Successful exploitation requires an attacker to provide a user with a specially crafted VI.  This vulnerability affects LabVIEW 2024 Q1 and prior versions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1285
References: https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/improper-error-handling-issues-in-labview.html; https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/improper-error-handling-issues-in-labview.html
CVE: CVE-2024-23610
Published: 2024-03-11
Description: An out of bounds write due to a missing bounds check in LabVIEW may result in remote code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q1 and prior versions.



CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/out-of-bounds-write-due-to-missing-bounds-check-in-labview.html; https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/out-of-bounds-write-due-to-missing-bounds-check-in-labview.html
CVE: CVE-2024-23611
Published: 2024-03-11
Description: An out of bounds write due to a missing bounds check in LabVIEW may result in remote code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q1 and prior versions.


CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/out-of-bounds-write-due-to-missing-bounds-check-in-labview.html; https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/out-of-bounds-write-due-to-missing-bounds-check-in-labview.html
CVE: CVE-2024-23612
Published: 2024-03-11
Description: An improper error handling vulnerability in LabVIEW may result in remote code execution.  Successful exploitation requires an attacker to provide a user with a specially crafted VI.  This vulnerability affects LabVIEW 2024 Q1 and prior versions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1285
References: https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/improper-error-handling-issues-in-labview.html; https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/improper-error-handling-issues-in-labview.html
CVE: CVE-2024-0039
Published: 2024-03-11
Description: In attp_build_value_cmd of att_protocol.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://android.googlesource.com/platform/packages/modules/Bluetooth/+/015c618a0461def93138173a53daaf27ca0630c9; https://android.googlesource.com/platform/packages/modules/Bluetooth/+/17044ccf3a2858633cad8f87926e752edfe0d8d8; https://android.googlesource.com/platform/packages/modules/Bluetooth/+/f0f[PII_REDACTED]8d1f3a660b151804e90d0249af3
CVE: CVE-2024-0044
Published: 2024-03-11
Description: In createSessionInternal of PackageInstallerService.java, there is a possible run-as any app due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-74, CWE-75
References: https://android.googlesource.com/platform/frameworks/base/+/836750619a8bce0bf78fe0549f9990e294671563; https://android.googlesource.com/platform/frameworks/base/+/954b2874b85b6cd0d6bb12cd677cdf22e5dbd77b; https://source.android.com/security/bulletin/2024-10-01
CVE: CVE-2024-0045
Published: 2024-03-11
Description: In smp_proc_sec_req of smp_act.cc, there is a possible out of bounds read due to improper input validation. This could lead to remote (proximal/adjacent) information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-20
References: https://android.googlesource.com/platform/packages/modules/Bluetooth/+/7d0f696f450241d8ba7a168ba14fa7b75032f0c9; https://source.android.com/security/bulletin/2024-03-01; https://android.googlesource.com/platform/packages/modules/Bluetooth/+/7d0f696f450241d8ba7a168ba14fa7b75032f0c9
CVE: CVE-2024-0046
Published: 2024-03-11
Description: In installExistingPackageAsUser of InstallPackageHelper.java, there is a possible carrier restriction bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://android.googlesource.com/platform/frameworks/base/+/d68cab5ac1aa294ec4d0419bc0803a5577e4e43c; https://source.android.com/security/bulletin/2024-03-01; https://android.googlesource.com/platform/frameworks/base/+/d68cab5ac1aa294ec4d0419bc0803a5577e4e43c
CVE: CVE-2024-0047
Published: 2024-03-11
Description: In writeUserLP of UserManagerService.java, device policies are serialized with an incorrect tag due to a logic error in the code. This could lead to local denial of service when policies are deserialized on reboot with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-502
References: https://android.googlesource.com/platform/frameworks/base/+/3cd8a2c783fc736627b38f639fe4e239abcf6af1; https://android.googlesource.com/platform/frameworks/base/+/bd5cc7f03256b328438b9bc3791c6b811a2f1f17; https://android.googlesource.com/platform/frameworks/base/+/f[PII_REDACTED]46fef7e0cf1437d9a40e2ad3c10bb
CVE: CVE-2024-0048
Published: 2024-03-11
Description: In Session of AccountManagerService.java, there is a possible method to retain foreground service privileges due to incorrect handling of null responses. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-230
References: https://android.googlesource.com/platform/frameworks/base/+/2c236cde5505ee0e88cf1e3d073e2f1a53f0eede; https://source.android.com/security/bulletin/2024-03-01; https://android.googlesource.com/platform/frameworks/base/+/2c236cde5505ee0e88cf1e3d073e2f1a53f0eede
CVE: CVE-2024-0049
Published: 2024-03-11
Description: In multiple locations, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User  interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-269
References: https://android.googlesource.com/platform/frameworks/av/+/462689f06fd5e72ac63cd87b43ee52554ddf953e; https://source.android.com/security/bulletin/2024-03-01; https://android.googlesource.com/platform/frameworks/av/+/462689f06fd5e72ac63cd87b43ee52554ddf953e