CVE-2024-47026: Zuma Pro Buffer Over-Read Vulnerability Leading to Information Disclosure
Summary
CVE-2024-47026: In gsc_gsa_rescue of gsc_gsa.c, there is a possible out of bounds read due to an incorrect bounds check. Affects :unknown: versions >= Pixel-family specific:0, < Pixel-family specific:2024-10-05. Fixed in Pixel-family specific:2024-10-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Zuma Pro is a popular package used in Android applications, known for its graphical and interactive features. It allows developers to create engaging user interfaces and manage complex data interactions. However, like many software packages, it is susceptible to vulnerabilities that can compromise user data and application integrity. This specific vulnerability arises from an incorrect bounds check in the gsc_gsa_rescue function, potentially exposing sensitive information.
Vulnerability Detail
The vulnerability identified as CVE-2024-47026 is a buffer over-read issue in the gsc_gsa_rescue function of gsc_gsa.c. This flaw occurs due to an improper bounds check, which can lead to an out-of-bounds read. As a result, local information may be disclosed without requiring additional execution privileges. Exploitation of this vulnerability does not necessitate user interaction, making it particularly concerning for applications utilizing the affected package.
How To Fix
Minimum fixed version
Pixel-family specific:2024-10-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds recommended for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
CVE-2024-47026 represents a serious vulnerability in the Zuma Pro package, allowing for potential information disclosure through a buffer over-read. Users are strongly advised to update to the patched version released on October 5, 2024, to protect their applications from exploitation. Regular monitoring for vulnerabilities, such as using Vulert, can help maintain application security.
See every vulnerability recorded for :unknown: →
FAQ
CVE-2024-47026 is a vulnerability in the Zuma Pro package that allows for potential buffer over-reads, leading to information disclosure.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The primary risk is local information disclosure, which could expose sensitive data to unauthorized users.
No, user interaction is not needed for exploitation, making it a significant risk for applications.
While there are no specific workarounds, it is crucial to prioritize updating to the patched version as soon as possible to mitigate risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for :unknown:.
