CVE-2024-43767
published 2025-01-03CVE-2024-43767: In prepare_to_draw_into_mask of SkBlurMaskFilterImpl.cpp, there is a possible heap overflow due to improper input validation. This could lead to remote code…
PriorityP353high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
0.38%
29.7th percentile
In prepare_to_draw_into_mask of SkBlurMaskFilterImpl.cpp, there is a possible heap overflow due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | libskia | — | — |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| platform | external_skia | >= 12:0 < 12:2024-12-01 | 12:2024-12-01 |
| platform | external_skia | >= 12L:0 < 12L:2024-12-01 | 12L:2024-12-01 |
| platform | external_skia | >= 13:0 < 13:2024-12-01 | 13:2024-12-01 |
| platform | external_skia | >= 14:0 < 14:2024-12-01 | 14:2024-12-01 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vendor_debian8.8LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Android
CVE-2024-43767: Android Security Bulletin 2024-12-01
CVE: CVE-2024-43767
Severity: HIGH
Type: RCE
Affected AOSP versions: 12, 12L, 13, 14, 15
References: A-352631932
vendor_android·2024-12-01·CVSS 8.8
CVE-2024-43767 [HIGH] CVE-2024-43767: Android Security Bulletin 2024-12-01
CVE: CVE-2024-43767
Severity: HIGH
Type: RCE
Affected AOSP versions: 12, 12L, 13, 14, 15
References: A-352631932
Android Security Bulletin 2024-12-01
CVE: CVE-2024-43767
Severity: HIGH
Type: RCE
Affected AOSP versions: 12, 12L, 13, 14, 15
References: A-352631932
Debian
CVE-2024-43767: libskia - In prepare_to_draw_into_mask of SkBlurMaskFilterImpl.cpp, there is a possible he...
vendor_debian·2024·CVSS 8.8
CVE-2024-43767 [HIGH] CVE-2024-43767: libskia - In prepare_to_draw_into_mask of SkBlurMaskFilterImpl.cpp, there is a possible he...
In prepare_to_draw_into_mask of SkBlurMaskFilterImpl.cpp, there is a possible heap overflow due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
Scope: local
forky: resolved
sid: resolved
GHSA
Liferay Portal allows open redirect in /c/portal/edit_info_item parameter redirect
ghsa·2025-08-23
CVE-2025-43767 [MEDIUM] CWE-601 Liferay Portal allows open redirect in /c/portal/edit_info_item parameter redirect
Liferay Portal allows open redirect in /c/portal/edit_info_item parameter redirect
Open Redirect vulnerability in /c/portal/edit_info_item parameter redirect in Liferay Portal 7.4.3.86 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.9, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 update 86 through update 92 allows an attacker to exploit this security vulnerability to redirect users to a malicious site.
GHSA
GHSA-q7cq-v47g-g2v2: In prepare_to_draw_into_mask of SkBlurMaskFilterImpl
ghsa_unreviewed·2025-01-03
CVE-2024-43767 [HIGH] CWE-120 GHSA-q7cq-v47g-g2v2: In prepare_to_draw_into_mask of SkBlurMaskFilterImpl
In prepare_to_draw_into_mask of SkBlurMaskFilterImpl.cpp, there is a possible heap overflow due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
OSV
CVE-2024-43767: In prepare_to_draw_into_mask of SkBlurMaskFilterImpl
osv·2024-12-01
CVE-2024-43767 CVE-2024-43767: In prepare_to_draw_into_mask of SkBlurMaskFilterImpl
In prepare_to_draw_into_mask of SkBlurMaskFilterImpl.cpp, there is a possible heap overflow due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-01-03
Published