CVE-2024-43767

EUVD-2024-40411
In prepare_to_draw_into_mask of SkBlurMaskFilterImpl.cpp, there is a possible heap overflow due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
Code Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 42.51%
Affected Products (NVD)
VendorProductVersion
googleandroid
12.0
googleandroid
12.1
googleandroid
13.0
googleandroid
14.0
googleandroid
15.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
libskia
forky
146.20260602~git.3476902+dfsg-4
fixed
sid
146.20260602~git.3476902+dfsg-4
fixed
webkit2gtk
bookworm
vulnerable
bookworm (security)
vulnerable
forky
vulnerable
sid
vulnerable
trixie
vulnerable
trixie (security)
2.54.0-1~deb13u1
fixed
wpewebkit
bookworm
ignored
forky
2.54.0-2
fixed
sid
2.54.0-2
fixed
trixie
ignored
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
libskia
jammy
dne
noble
dne
resolute
needs-triage
webkitgtk
bionic
ignored
jammy
dne
noble
dne
resolute
dne
xenial
ignored
webkit2gtk
bionic
ignored
focal
ignored
jammy
ignored
noble
deferred
resolute
deferred
xenial
ignored
qtwebkit-source
bionic
ignored
jammy
dne
noble
dne
resolute
dne
xenial
ignored
qtwebkit-opensource-src
bionic
ignored
focal
ignored
jammy
ignored
noble
ignored
resolute
dne
xenial
ignored
wpewebkit
focal
ignored
jammy
ignored
noble
dne
resolute
dne
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
libjavascriptcoregtk-4_0-18
suse enterprise sap 15 SP4
2.54.1-150400.4.152.2
fixed
suse enterprise sap 15 SP5
2.54.1-150400.4.152.2
fixed
suse enterprise server 15 SP4
2.54.1-150400.4.152.2
fixed
suse enterprise server 15 SP5
2.54.1-150400.4.152.2
fixed
libjavascriptcoregtk-4_1-0
suse enterprise sap 15 SP4
2.54.1-150400.4.152.2
fixed
suse enterprise sap 15 SP5
2.54.1-150400.4.152.2
fixed
suse enterprise server 15 SP4
2.54.1-150400.4.152.2
fixed
suse enterprise server 15 SP5
2.54.1-150400.4.152.2
fixed
libjavascriptcoregtk-6_0-1
suse enterprise sap 15 SP4
2.54.1-150400.4.152.2
fixed
suse enterprise sap 15 SP5
2.54.1-150400.4.152.2
fixed
suse enterprise server 15 SP4
2.54.1-150400.4.152.2
fixed
suse enterprise server 15 SP5
2.54.1-150400.4.152.2
fixed
libwebkit2gtk-4_0-37
suse enterprise sap 15 SP4
2.54.1-150400.4.152.2
fixed
suse enterprise sap 15 SP5
2.54.1-150400.4.152.2
fixed
suse enterprise server 15 SP4
2.54.1-150400.4.152.2
fixed
suse enterprise server 15 SP5
2.54.1-150400.4.152.2
fixed
libwebkit2gtk-4_1-0
suse enterprise sap 15 SP4
2.54.1-150400.4.152.2
fixed
suse enterprise sap 15 SP5
2.54.1-150400.4.152.2
fixed
suse enterprise server 15 SP4
2.54.1-150400.4.152.2
fixed
suse enterprise server 15 SP5
2.54.1-150400.4.152.2
fixed
libwebkitgtk-6_0-4
suse enterprise sap 15 SP4
2.54.1-150400.4.152.2
fixed
suse enterprise sap 15 SP5
2.54.1-150400.4.152.2
fixed
suse enterprise server 15 SP4
2.54.1-150400.4.152.2
fixed
suse enterprise server 15 SP5
2.54.1-150400.4.152.2
fixed
typelib-1_0-JavaScriptCore-4_0
suse enterprise sap 15 SP4
2.54.1-150400.4.152.2
fixed
suse enterprise sap 15 SP5
2.54.1-150400.4.152.2
fixed
suse enterprise server 15 SP4
2.54.1-150400.4.152.2
fixed
suse enterprise server 15 SP5
2.54.1-150400.4.152.2
fixed
typelib-1_0-JavaScriptCore-4_1
suse enterprise sap 15 SP4
2.54.1-150400.4.152.2
fixed
suse enterprise sap 15 SP5
2.54.1-150400.4.152.2
fixed
suse enterprise server 15 SP4
2.54.1-150400.4.152.2
fixed
suse enterprise server 15 SP5
2.54.1-150400.4.152.2
fixed
typelib-1_0-WebKit2-4_0
suse enterprise sap 15 SP4
2.54.1-150400.4.152.2
fixed
suse enterprise sap 15 SP5
2.54.1-150400.4.152.2
fixed
suse enterprise server 15 SP4
2.54.1-150400.4.152.2
fixed
suse enterprise server 15 SP5
2.54.1-150400.4.152.2
fixed
typelib-1_0-WebKit2-4_1
suse enterprise sap 15 SP4
2.54.1-150400.4.152.2
fixed
suse enterprise sap 15 SP5
2.54.1-150400.4.152.2
fixed
suse enterprise server 15 SP4
2.54.1-150400.4.152.2
fixed
suse enterprise server 15 SP5
2.54.1-150400.4.152.2
fixed
typelib-1_0-WebKit2WebExtension-4_0
suse enterprise sap 15 SP4
2.54.1-150400.4.152.2
fixed
suse enterprise sap 15 SP5
2.54.1-150400.4.152.2
fixed
suse enterprise server 15 SP4
2.54.1-150400.4.152.2
fixed
suse enterprise server 15 SP5
2.54.1-150400.4.152.2
fixed
typelib-1_0-WebKit2WebExtension-4_1
suse enterprise sap 15 SP4
2.54.1-150400.4.152.2
fixed
suse enterprise sap 15 SP5
2.54.1-150400.4.152.2
fixed
suse enterprise server 15 SP4
2.54.1-150400.4.152.2
fixed
suse enterprise server 15 SP5
2.54.1-150400.4.152.2
fixed
webkit2gtk-4_0-injected-bundles
suse enterprise sap 15 SP4
2.54.1-150400.4.152.2
fixed
suse enterprise sap 15 SP5
2.54.1-150400.4.152.2
fixed
suse enterprise server 15 SP4
2.54.1-150400.4.152.2
fixed
suse enterprise server 15 SP5
2.54.1-150400.4.152.2
fixed
webkit2gtk-4_1-injected-bundles
suse enterprise sap 15 SP4
2.54.1-150400.4.152.2
fixed
suse enterprise sap 15 SP5
2.54.1-150400.4.152.2
fixed
suse enterprise server 15 SP4
2.54.1-150400.4.152.2
fixed
suse enterprise server 15 SP5
2.54.1-150400.4.152.2
fixed
webkit2gtk3-devel
suse enterprise sap 15 SP4
2.54.1-150400.4.152.2
fixed
suse enterprise sap 15 SP5
2.54.1-150400.4.152.2
fixed
suse enterprise server 15 SP4
2.54.1-150400.4.152.2
fixed
suse enterprise server 15 SP5
2.54.1-150400.4.152.2
fixed
webkit2gtk3-soup2-devel
suse enterprise sap 15 SP4
2.54.1-150400.4.152.2
fixed
suse enterprise sap 15 SP5
2.54.1-150400.4.152.2
fixed
suse enterprise server 15 SP4
2.54.1-150400.4.152.2
fixed
suse enterprise server 15 SP5
2.54.1-150400.4.152.2
fixed
webkitgtk-6_0-injected-bundles
suse enterprise sap 15 SP4
2.54.1-150400.4.152.2
fixed
suse enterprise sap 15 SP5
2.54.1-150400.4.152.2
fixed
suse enterprise server 15 SP4
2.54.1-150400.4.152.2
fixed
suse enterprise server 15 SP5
2.54.1-150400.4.152.2
fixed
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://android.googlesource.com/platform/external/skia/+/796c2040f641bb287dba66c9823ce45e9f8b5807
https://source.android.com/security/bulletin/2024-12-01