2 lines
2.9 KiB
JSON
2 lines
2.9 KiB
JSON
{"affected":[{"affectedData":[{"product":"Android","vendor":"n/a","versions":[{"status":"affected","version":"Android-10"}]}],"source":"security@android.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:google:android:10.0:*:*:*:*:*:*:*","matchCriteriaId":"D558D965-FA70-4822-A770-419E73BA9ED3","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In InstallPackage of package.cpp, there is a possible bypass of a signature check due to a Time of Check/Time of Use condition. This could lead to local escalation of privilege by allowing a bypass of the initial zip file signature check for an OS update with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-136498130"},{"lang":"es","value":"En la función InstallPackage del archivo package.cpp, se presenta una posible omisión de una comprobación de firma debido a una condición Time of Check/Time of Use. Esto podría conllevar a una escalada de privilegios local al permitir una omisión de la comprobación inicial de la firma del archivo zip para una actualización del sistema operativo sin ser necesarios privilegios de ejecución adicionales. Es requerida una interacción del usuario para su explotación. Producto: Android, Versiones: Android-10, ID de Android: A-136498130"}],"id":"CVE-2020-0204","lastModified":"2026-06-17T02:45:25.043","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"HIGH","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"PARTIAL","baseScore":5.1,"confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:H/Au:N/C:P/I:P/A:P","version":"2.0"},"exploitabilityScore":4.9,"impactScore":6.4,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":true}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2020-06-11T15:15:17.333","references":[{"source":"security@android.com","tags":["Patch","Vendor Advisory"],"url":"https://source.android.com/security/bulletin/pixel/2020-06-01"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"url":"https://source.android.com/security/bulletin/pixel/2020-06-01"}],"sourceIdentifier":"security@android.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"}],"source":"nvd@nist.gov","type":"Primary"}]}
|