CVE-2023-21103 — Information Exposure via Error Message in Google Android

CWE-209 — Information Exposure via Error Message5 documents5 sources
Severity
5.5MEDIUMNVD
EPSS
0.0%
top 88.38%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Platform Frameworks BasePlatform Packages Services TelecommGoogle Android
Timeline
PublishedMay 15
Latest updateNov 1

Description

In registerPhoneAccount of PhoneAccountRegistrar.java, uncaught exceptions in parsing persisted user data could lead to local persistent denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-259064622

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages4 packages

▶CVEListV5google/androidAndroid-11 Android-12 Android-12L Android-13
▶NVDgoogle/android4 versions+3
▶Androidplatform/packages_services_telecomm14-next:0 — 14-next:2023-11-01+4
▶Androidplatform/frameworks_base14-next:0 — 14-next:2023-11-01+4

Patches

Patch: source.android.com ↗Patch: source.android.com ↗

🔴Vulnerability Details

3
OSV
CVE-2023-21103: In registerPhoneAccount of PhoneAccountRegistrar↗2023-11-01
▶
GHSA
GHSA-7p8r-xg5m-xgx8: In registerPhoneAccount of PhoneAccountRegistrar↗2023-05-16
▶
CVEList
CVE-2023-21103: In registerPhoneAccount of PhoneAccountRegistrar↗2023-05-15
▶

📋Vendor Advisories

1
Android
CVE-2023-21103: Android Security Bulletin 2023-11-01 CVE: CVE-2023-21103 Severity: HIGH Type: DoS Affected AOSP versions: 11, 12, 12L, 13 References: A-259064622 [2]↗2023-11-01
▶
CVE-2023-21103 — Information Exposure via Error Message | cvebase