Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Mobile & Wireless

94 Vulnerabilities Patched in Android With December 2023 Security Updates

Android’s December 2023 security updates resolve 94 vulnerabilities, including several critical-severity bugs.

Google on Monday announced that the December 2023 Android security updates deliver patches for 94 vulnerabilities.

The first part of the updates – the 2023-12-01 security patch level – resolves 33 vulnerabilities in Android’s Framework and System components. Three of these are rated ‘critical severity’.

“The most severe of these issues is a critical security vulnerability in the System component that could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed,” Google notes in its advisory.

Tracked as CVE-2023-40088, the RCE flaw impacts Android 11, 12, 12L, 13, and 14 and does not require user interaction for successful exploitation, the internet giant explains.

The latest Android update resolves 15 other issues in the System component, namely 10 elevation of privilege issues and five information disclosure bugs. All are rated ‘high severity’.

The update also patches 17 vulnerabilities in the Framework component, including two critical bugs leading to elevation of privilege and information disclosure.

A total of 61 issues were resolved with the second part of this month’s Android updates – the 2023-12-05 security patch level –, including two critical-severity flaws.

The bugs impact System, Arm, Imagination Technologies, MediaTek, Misc OEM, Unisoc, and Qualcomm components.

Advertisement. Scroll to continue reading.

The 2023-12-05 security patch level resolves all 61 issues and the vulnerabilities addressed as part of the 2023-12-01 security patch level.

On Monday, Google also announced that patches for an elevation of privilege vulnerability (CVE-2023-40094) were included in the December 2023 Wear OS security update. No CVE is mentioned in the December 2023 Android Automotive security bulletin.

The company has yet to publish a security bulletin describing this month’s updates for Pixel devices.

Google makes no mention of any of the vulnerabilities addressed this month being exploited in the wild.

Related: 37 Vulnerabilities Patched in Android With November 2023 Security Updates

Related: Android’s October 2023 Security Updates Patch Two Exploited Vulnerabilities

Related: Android Zero-Day Patched With September 2023 Security Updates

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Gain valuable insights from industry professionals who will help guide you through the intricacies of industrial cybersecurity.

Register

Join us for an in depth exploration of the critical nature of software and vendor supply chain security issues with a focus on understanding how attacks against identity infrastructure come with major cascading effects.

Register

Expert Insights

Related Content

Mobile & Wireless

Infonetics Research has shared excerpts from its Mobile Device Security Client Software market size and forecasts report, which tracks enterprise and consumer security client...

Mobile & Wireless

Samsung smartphone users warned about CVE-2023-21492, an ASLR bypass vulnerability exploited in the wild, likely by a spyware vendor.

Malware & Threats

Apple’s cat-and-mouse struggles with zero-day exploits on its flagship iOS platform is showing no signs of slowing down.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Mobile & Wireless

Critical security flaws expose Samsung’s Exynos modems to “Internet-to-baseband remote code execution” attacks with no user interaction. Project Zero says an attacker only needs...

Fraud & Identity Theft

A team of researchers has demonstrated a new attack method that affects iPhone owners who use Apple Pay and Visa payment cards. The vulnerabilities...

Mobile & Wireless

Two vulnerabilities in Samsung’s Galaxy Store that could be exploited to install applications or execute JavaScript code by launching a web page.

Mobile & Wireless

Asus patched nine WiFi router security defects, including a highly critical 2018 vulnerability that exposes users to code execution attacks.