37 VULNERABILITIES PATCHED IN ANDROID WITH NOVEMBER 2023 SECURITY UPDATES

The Android security updates released this week resolve 37 vulnerabilities, including a critical information disclosure bug.

Google on Monday announced patches for 37 vulnerabilities as part of the November 2023 Android security updates, with additional fixes released for Pixel devices.

The first part of the security update will arrive on devices as the 2023-11-01 security patch level, addressing 15 vulnerabilities in Android’s Framework and System components.

“The most severe of these issues is a critical security vulnerability in the System component that could lead to local information disclosure with no additional execution privileges needed,” Google notes in its advisory.

The bug is tracked as CVE-2023-40113, impacts Android versions 11, 12, 12L, and 13, and was addressed alongside six other issues in the System component, which are rated ‘high severity’.

In fact, all the remaining 14 vulnerabilities that the 2023-11-01 security patch level resolves are high-severity flaws. They could lead to elevation of privilege, information disclosure, and denial-of-service.

The second part of Android’s November 2023 security update arrives on devices as the 2023-11-05 security patch level and addresses 22 security defects in Arm, MediaTek, and Qualcomm components.

Devices running a security patch level of 2023-10-05 contain patches for all the issues described in Android’s November 2023 and previous security bulletins.

Additionally, Google has announced kernel version updates for Android 11 to 13.

This week, the internet giant also announced patches for eight vulnerabilities in Pixel devices, including three affecting the Kernel and WLAN components and five in Qualcomm components.

On Pixel devices, a security patch level of 2023-11-01 or later resolves these seven flaws along with all the bugs the November 2023 Android security updates resolve.

While no separate patches have been released for Wear OS and Automotive OS this month, updates released this week address all the bugs resolved with the Android security patch level of 2023-10-05 or later.

Google makes no mention of any of these vulnerabilities being exploited in malicious attacks.