Google has released its Android security updates for October 2023 , addressing 54 vulnerabilities. Among them are two that are being used in targeted attacks.
The two vulnerabilities that have been used are CVE-2023-4863 and CVE-2023-4211.
CVE -2023-4863 is a buffer overflow vulnerability in the open-source library libwebp, which affects many software products, including Chrome, Firefox, iOS, Microsoft Teams and many others.
See also: Android: How to enable the new earthquake notification system
The vulnerability, CVE-2023-4211, affects multiple versions of Arm Mali GPU drivers used in a wide range of Android device models. The effects of this vulnerability have been observed in targeted attacks. It is a use-after-free memory issue that could allow attackers to gain local access or steal sensitive data.
Overall, Android security updates for October 2023 bring:
- 13 fixes in the Android Framework
- 12 fixes in System components
- Two updates on Google Play
- Five fixes in Arm components
- Three patches concerning MediaTek chips
- One patch concerning Unisoc chips
- 18 fixes to Qualcomm components (15 for closed-source)
Out of the 54 fixes covering Android versions 11 to 13, five have been classified as critical, and two involve remote code execution issues.
See also: Zanubis: Android banking trojan becomes even more dangerous
As always, Android security updates come in two levels: the first (2023-10-01) focuses on the core components of Android (Framework + System), while the second (2023-10-06) addresses issues in kernel and closed-source components.
With this approach, device manufacturers can selectively apply updates specific to their models, making them available more quickly.
The recipients of the first level of notification will receive the core Android security updates for the current month, as well as the updates from the two levels of the previous month (i.e., September 2023).
Those who see the second level on the notification screen will receive all the updates listed in this month's bulletin.
See also: Xenomorph Android malware: Targets banking and crypto wallet users in the US
Android 10 and older versions are no longer supported, so users will need to purchase a newer model or upgrade device with a third-party Android distribution that offers security for their models.
It's important to understand that Android security updates are an extremely critical component in protecting Android devices from attacks and vulnerabilities. Google makes its security update approach accessible and flexible, allowing device manufacturers to selectively apply updates that apply to their models. However, users should also take care to keep their device secure.
Source: www.bleepingcomputer.com
