CVE-2024-0015: In convertToComponentName of DreamService.java, there is a possible way to launch arbitrary protected activities due to intent redirection. This could lead to…

PriorityP343high7.8CVSS 3.1

AVLACLPRLUINSUCHIHAH

EPSS

0.38%

30.2th percentile

In convertToComponentName of DreamService.java, there is a possible way to launch arbitrary protected activities due to intent redirection. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.

Affected

14 ranges

Vendor	Product	Version range	Fixed in
google	android	—	—
google	android	—	—
google	android	—	—
google	android	—	—
google	android	—	—
google	android	—	—
google	android	—	—
google	android	—	—
google	android	—	—
platform	frameworks_base	>= 11:0 < 11:2024-01-01	11:2024-01-01
platform	frameworks_base	>= 12:0 < 12:2024-01-01	12:2024-01-01
platform	frameworks_base	>= 12L:0 < 12L:2024-01-01	12L:2024-01-01
platform	frameworks_base	>= 13:0 < 13:2024-01-01	13:2024-01-01
platform	frameworks_base	>= 14-next:0 < 14-next:2024-01-01	14-next:2024-01-01

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

cisa9.8CRITICAL

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

Suricata

GPL MISC CVS invalid directory response

suricata·2010-09-23

CVE-2003-0015 GPL MISC CVS invalid directory response GPL MISC CVS invalid directory response Rule: alert tcp $HOME_NET 2401 -> $EXTERNAL_NET any (msg:"GPL MISC CVS invalid directory response"; flow:established,to_client; content:"E protocol error|3A| invalid directory syntax in"; reference:bugtraq,6650; reference:cve,2003-0015; classtype:misc-attack; sid:2102011; rev:6; metadata:created_at 2010_09_23, cve CVE_2003_0015, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_08;)

Suricata

GPL MISC CVS double free exploit attempt response

suricata·2010-09-23

CVE-2003-0015 GPL MISC CVS double free exploit attempt response GPL MISC CVS double free exploit attempt response Rule: alert tcp $HOME_NET 2401 -> $EXTERNAL_NET any (msg:"GPL MISC CVS double free exploit attempt response"; flow:established,to_client; content:"free|28 29 3A| warning|3A| chunk is already free"; reference:bugtraq,6650; reference:cve,2003-0015; classtype:misc-attack; sid:2102010; rev:6; metadata:created_at 2010_09_23, cve CVE_2003_0015, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_08;)

Suricata

ET WEB_CLIENT Apple Quicktime RTSP Overflow (2)

suricata·2010-07-30

CVE-2007-0015 ET WEB_CLIENT Apple Quicktime RTSP Overflow (2) ET WEB_CLIENT Apple Quicktime RTSP Overflow (2) Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Apple Quicktime RTSP Overflow (2)"; flow:established,to_client; file.data; content:"|27|rtsp|3a|//"; nocase; isdataat:400,relative; content:!"|0a|"; within:400; content:!"|27|"; within:400; reference:cve,2007-0015; reference:bugtraq,21829; classtype:attempted-admin; sid:2003327; rev:11; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_07_30, cve CVE_2007_0015, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2024_04_11;)

Suricata

ET WEB_CLIENT Apple Quicktime RTSP Overflow (1)

suricata·2010-07-30

CVE-2007-0015 ET WEB_CLIENT Apple Quicktime RTSP Overflow (1) ET WEB_CLIENT Apple Quicktime RTSP Overflow (1) Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Apple Quicktime RTSP Overflow (1)"; flow:established,to_client; file.data; content:"|22|rtsp|3a|//"; fast_pattern; nocase; isdataat:400,relative; content:!"|0a|"; within:400; content:!"|22|"; within:400; reference:cve,2007-0015; reference:bugtraq,21829; classtype:attempted-admin; sid:2003326; rev:11; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_07_30, cve CVE_2007_0015, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2024_04_11;)