corp.mediatek.com
Open in
urlscan Pro
2600:9000:21f3:1200:e:118e:5f00:93a1
Public Scan
URL:
https://corp.mediatek.com/product-security-bulletin/February-2023
Submission: On February 14 via api from US — Scanned from DE
Submission: On February 14 via api from US — Scanned from DE
Form analysis
2 forms found in the DOMhttps://corp.mediatek.com/search/results
<form action="https://corp.mediatek.com/search/results" style="width: 100%">
<input type="search" name="q" placeholder="What are you looking for?">
</form>
Name: frmLB1055731 — POST https://lb.benchmarkemail.com//code/lbform
<form style="display:inline;" action="https://lb.benchmarkemail.com//code/lbform" method="post" name="frmLB1055731" accept-charset="UTF-8" onsubmit="return _checkSubmit1055731(this);">
<input type="hidden" name="successurl" value="https://www.benchmarkemail.com/Code/ThankYouOptin">
<input type="hidden" name="errorurl" value="http://lb.benchmarkemail.com//Code/Error">
<input type="hidden" name="token" value="mFcQnoBFKMS8uZJPC65QKVcgGr0xQgnh%2Fjei5kp4ptOEbjMi4LaEbg%3D%3D">
<input type="hidden" name="doubleoptin" value="">
<div class="formbox-title-1055731">JOIN OUR NEWSLETTER</div>
<div class="formbox-body">
<fieldset>
<fieldset class="formbox-field-fname-1055731">
<input type="text" placeholder="First Name *" class="formbox-field-1055731" name="fldfirstname" maxlength="100">
</fieldset>
<fieldset class="formbox-field-add-1055731">
<input type="text" placeholder="Last Name *" class="formbox-field-1055731" name="fldlastname" maxlength="100">
</fieldset>
</fieldset>
<fieldset class="formbox-field-email-1055731">
<input type="text" placeholder="Email Address *" class="formbox-field-1055731" name="fldEmail" maxlength="100">
</fieldset>
<button type="submit" id="btnSubmit" krydebug="1751" class="formbox-button-1055731">SUBMIT</button>
</div>
</form>
Text Content
This website stores cookies on your computer. These cookies are used to collect information about how you interact with our website and allow us to remember you. We use this information in order to improve and customize your browsing experience and for analytics and metrics about our visitors both on this website and other media. To find out more about the cookies we use, see our Privacy Policy. If you decline, your information won’t be tracked when you visit this website. A single cookie will be used in your browser to remember your preference not to be tracked. Accept Decline English * 简体中文 * 繁體中文 * Products & Technology * Overview * Overview * Overview * Pumpkin Software * MiraVision for Smartphones * Investor Relations * Financial Information * Overview * Monthly Revenue * Quarterly Earnings Release * Financial Reports * Annual Reports * Overview * Overview * 1. Financial Status * 2. Operating Results * 3. Cash Flow Analysis * 4. Major Capital Expenditure * 5. Investment Policies * 6. Risk Management * 1. Condensed Balance Sheet * 2. Condensed Statements of Comprehensive Income / Statements of Income * 3. Auditors’ Opinions from 2012 to 2016 * 4. Five Year Financial Analysis * 1. Financial Status * 2. Operating Results * 3. Cash Flow Analysis * 4. Major Capital Expenditure * 5. Investment Policies * 6. Risk Management * 1. Condensed Balance Sheet * 2. Condensed Statements of Comprehensive Income / Statements of Income * 3. Auditors’ Opinions from 2011 to 2015 * 4. Five-Year Financial Analysis * 1. Financial Status * 2. Operating Results * 3. Cash Flow Analysis * 4. Major Capital Expenditure * 5. Investment Policies * 6. Risk Management * 1. Condensed Balance Sheets * 2. Condensed Statements of Comprehensive Income / Statements of Income * 3. Auditors’ Opinions from 2010 to 2014 * 4. Five-Year Financial Analysis * 1. Financial Status * 2. Operating Results * 3. Cash Flow Analysis * 4. Major Capital Expenditure * 5. Investment Policies * 6. Risk Management * 1. Condensed Balance Sheets * 2. Condensed Income Statement * 3. Independent Auditors’ Opinions * 4. Financial Statements for the Past 5 Years * MediaTek ESG Highlight * Dividend History * Shareholder Services * Shareholder Meetings * Analyst Coverage * Transfer Agent Contact * Stock Quote * Material Information * M.O.P.S (2454) * FAQ * Investor News * Events Calendar * Contact Investor Relations * Corporate Governance * Overview * Board of Directors * Audit Committee * Remuneration Committee * M&A Strategy Committee * Corporate Management * Internal Auditing * About * About MediaTek * Everyday Genius * Awards & Recognition * MediaTek Ventures * MediaTek Foundation * Office Locations * Overview * China Offices * Dubai Offices * Finland Offices * Germany Offices * India Offices * Japan Offices * Korea Offices * Singapore Offices * Sweden Offices * Taiwan Offices * United Kingdom Offices * United States Offices * Subsidiary Information * Careers * Opportunities * Jobs at MediaTek * Internships * Overview * China * Overview * Gan Tang, Wireless Communications Intern * Han-bin, Wireless Communications Intern * 王琦 * 黄帅凯 * 李先驰, Wireless Communications Technology Intern * 王俊, HTD Intern * 吴波, HTD Intern * Shangjie, IOT Intern * Xiye, MB Intern * Europe * Overview * Adamos, Digital Design Verification Intern, Cambourne (Cambridge), UK * Alex, Communications Software Automation Intern, Cambourne (Cambridge), UK * Jacob, Communications Software Automation Intern, Cambourne (Cambridge), UK * Kip, Design Verification Intern, Kent, UK * Moji, Advanced Digital Communication Systems Modelling intern, Cambourne (Cambridge), UK * Sisi, Compute Platform Modelling Intern, Cambourne (Cambridge), UK * Sophie, Communications Software Automation Intern, Cambourne (Cambridge), UK * India * Overview * Subhalaxmi Sahoo, SOC Verification Intern * Manjunatha, DT Intern * Korea * Singapore * Overview * Meng Yuan, RF Design Intern * Skandkumar Sharma, RF Design Intern * Raahgini Chandrasegaran, Innovation Center Singapore * Jesslyn, ADCT Department Intern * Taiwan * Overview * Arthur, CSD Intern * Jia-Jen, RF Design IO Intern * Jieng-Wuen, Corporate Strategy Intern * Wen-Wei, Wireless Communications Department Intern * United States * Overview * Ahmad, RF Systems Design Intern * Thomas, High Performance Technology Intern * Hsin-Hui, Design Technology Intern * Michael, WCT Intern * Tzu-Chien, WCT Intern * Samuel, SPE Team Intern * Cho-Hsin, CSD Department Intern * Contact Us * Sustainability * Overview * Overview * Chairman’s Remarks * Sustainability Committee * Stakeholder Engagement * Sustainability Highlights * Corporate Governance * Global Presence * Brand Vision * Global Operations * Global Customer Service * Innovation * Core Concepts * Innovation in Practice * Innovation Achievements * Talent * Multinational Distribution * Best Employer * Training & Development * Employee Experience * Environmental Management * Sustainable Supply Chain * Climate Related Risk Management * Environmental Management * 2050 Net Zero Goals * Community Engagement * Social Innovation * Making Science Accessible * Community Involvement * ESG Newsletter * News * Press Room * Media Assets * Events * Blog * Language * English * 简体中文 * 繁體中文 * Home * Products & Technology * Investor Relations * About * News * Blog * February 2023 Announcement Report Vulnerability Disclosure Policy Security Bulletin Acknowledgements FEBRUARY 2023 PRODUCT SECURITY BULLETIN Published 2023-02-06 The MediaTek Product Security Bulletin contains details of security vulnerabilities affecting MediaTek Smartphone, Tablet, AIoT, Smart display, Smart platform, OTT and Wi-Fi chipsets. Device OEMs have been notified of all the issues and the corresponding security patches for at least two months before publication. The severity of the identified vulnerabilities was conducted based on the Common Vulnerability Scoring System version 3.1 (CVSS v3.1). SUMMARY Severity CVEs High CVE-2023-20602 Medium CVE-2023-20604, CVE-2023-20605, CVE-2023-20606, CVE-2023-20607, CVE-2023-20608, CVE-2023-20609, CVE-2023-20610, CVE-2023-20611, CVE-2023-20612, CVE-2023-20613, CVE-2023-20614, CVE-2023-20615, CVE-2023-20616, CVE-2023-20618, CVE-2023-20619, CVE-2022-32642, CVE-2022-32643, CVE-2022-32654, CVE-2022-32655, CVE-2022-32656, CVE-2022-32663 DETAILS CVE CVE-2023-20602 Title Improper input validation in ged Severity High Vulnerability Type EoP CWE CWE-20 Improper Input Validation Description In ged, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Affected Chipsets MT6735, MT6737, MT6739, MT6753, MT6757, MT6761, MT6763, MT6765, MT6768, MT6771, MT6779, MT6781, MT6785, MT6833, MT6853, MT6855, MT6873, MT6877, MT6879, MT6885, MT6889, MT6893, MT6895, MT6983 Affected Software Versions Android 10.0, 11.0, 12.0, 13.0 CVE CVE-2023-20604 Title Improper input validation in ged Severity Medium Vulnerability Type EoP CWE CWE-20 Improper Input Validation Description In ged, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Affected Chipsets MT6735, MT6737, MT6739, MT6753, MT6757, MT6761, MT6763, MT6765, MT6768, MT6771, MT6779, MT6781, MT6785, MT6833, MT6853, MT6855, MT6873, MT6877, MT6879, MT6885, MT6889, MT6893, MT6895, MT6983, MT8167, MT8362A Affected Software Versions Android 11.0, 12.0, 13.0 CVE CVE-2023-20605 Title Improper input validation in keyinstall Severity Medium Vulnerability Type ID CWE CWE-20 Improper Input Validation Description In keyinstall, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Affected Chipsets MT6580, MT6731, MT6735, MT6737, MT6739, MT6753, MT6757, MT6757C, MT6757CD, MT6757CH, MT6761, MT6762, MT6763, MT6765, MT6768, MT6769, MT6771, MT6779, MT6781, MT6785, MT6789, MT6833, MT6853, MT6853T, MT6855, MT6873, MT6875, MT6877, MT6879, MT6883, MT6885, MT6889, MT6891, MT6893, MT6895, MT6983, MT8185, MT8321, MT8385, MT8666, MT8667, MT8765, MT8766, MT8768, MT8786, MT8788, MT8789, MT8791, MT8791T, MT8797 Affected Software Versions Android 11.0, 12.0, 13.0 CVE CVE-2023-20606 Title Improper input validation in apusys Severity Medium Vulnerability Type ID CWE CWE-20 Improper Input Validation Description In apusys, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Affected Chipsets MT6879, MT6895, MT6983 Affected Software Versions Android 12.0, 12.1 CVE CVE-2023-20607 Title Improper synchronization in ccu Severity Medium Vulnerability Type EoP CWE CWE-662 Improper Synchronization Description In ccu, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Affected Chipsets MT6765, MT6768, MT8786 Affected Software Versions Android 11.0, 12.0 CVE CVE-2023-20608 Title Improper synchronization in display drm Severity Medium Vulnerability Type EoP CWE CWE-662 Improper Synchronization Description In display drm, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Affected Chipsets MT6761, MT6765, MT6768, MT6779, MT6781, MT6785, MT6789, MT6833, MT6853, MT6855, MT6873, MT6877, MT6879, MT6883, MT6885, MT6889, MT6893, MT6895, MT6983, MT8168, MT8365, MT8675 Affected Software Versions Android 11.0, 12.0, 13.0 CVE CVE-2023-20609 Title Out-of-bounds read in ccu Severity Medium Vulnerability Type ID CWE CWE-125 Out-of-bounds Read Description In ccu, there is a possible out of bounds read due to a logic error. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Affected Chipsets MT6833, MT6853, MT6873, MT6877, MT6885, MT6893, MT8768, MT8786, MT8791, MT8797 Affected Software Versions Android 11.0, 12.0, 13.0 CVE CVE-2023-20610 Title Improper synchronization in display drm Severity Medium Vulnerability Type EoP CWE CWE-662 Improper Synchronization Description In display drm, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Affected Chipsets MT6761, MT6765, MT6768, MT6779, MT6781, MT6785, MT6789, MT6833, MT6853, MT6855, MT6873, MT6877, MT6879, MT6883, MT6885, MT6889, MT6893, MT6895, MT6983, MT8168, MT8365, MT8675 Affected Software Versions Android 11.0, 12.0, 13.0 CVE CVE-2023-20611 Title Improper synchronization in gpu Severity Medium Vulnerability Type EoP CWE CWE-662 Improper Synchronization Description In gpu, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Affected Chipsets MT6580, MT6731, MT6735, MT6737, MT6739, MT6753, MT6757, MT6757C, MT6757CD, MT6757CH, MT6761, MT6762, MT6763, MT6765, MT6768, MT6769, MT6771, MT6779, MT6781, MT6785, MT6789, MT6833, MT6853, MT6853T, MT6855, MT6873, MT6875, MT6877, MT6879, MT6883, MT6885, MT6889, MT6891, MT6893, MT6895, MT6983, MT8168, MT8365 Affected Software Versions Android 12.0, 13.0 CVE CVE-2023-20612 Title Improper input validation in ril Severity Medium Vulnerability Type EoP CWE CWE-20 Improper Input Validation Description In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Affected Chipsets MT6739, MT6761, MT6762, MT6765, MT6768, MT6769, MT6771, MT6779, MT6781, MT6785, MT6789, MT6833, MT6853, MT6855, MT6873, MT6875, MT6877, MT6879, MT6883, MT6885, MT6889, MT6891, MT6893, MT6895, MT6983, MT8321, MT8385, MT8765, MT8766, MT8768, MT8786, MT8788, MT8789, MT8791, MT8791T, MT8797 Affected Software Versions Android 11.0, 12.0, 13.0 CVE CVE-2023-20613 Title Improper input validation in ril Severity Medium Vulnerability Type EoP CWE CWE-20 Improper Input Validation Description In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Affected Chipsets MT6739, MT6761, MT6762, MT6765, MT6768, MT6769, MT6771, MT6779, MT6781, MT6785, MT6789, MT6833, MT6853, MT6855, MT6873, MT6875, MT6877, MT6879, MT6883, MT6885, MT6889, MT6891, MT6893, MT6895, MT6983, MT8321, MT8385, MT8765, MT8766, MT8768, MT8786, MT8788, MT8789, MT8791, MT8791T, MT8797 Affected Software Versions Android 11.0, 12.0, 13.0 CVE CVE-2023-20614 Title Out-of-bounds write in ril Severity Medium Vulnerability Type EoP CWE CWE-787 Out-of-bounds Write Description In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Affected Chipsets MT6739, MT6761, MT6762, MT6765, MT6768, MT6769, MT6771, MT6779, MT6781, MT6785, MT6789, MT6833, MT6853, MT6853T, MT6855, MT6873, MT6875, MT6877, MT6879, MT6883, MT6885, MT6889, MT6891, MT6893, MT6895, MT6983, MT8321, MT8385, MT8765, MT8766, MT8768, MT8786, MT8788, MT8789, MT8791, MT8791T, MT8797 Affected Software Versions Android 11.0, 12.0, 13.0 CVE CVE-2023-20615 Title Out-of-bounds write in ril Severity Medium Vulnerability Type EoP CWE CWE-787 Out-of-bounds Write Description In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Affected Chipsets MT6739, MT6761, MT6762, MT6765, MT6768, MT6769, MT6771, MT6779, MT6781, MT6785, MT6789, MT6833, MT6853, MT6855, MT6873, MT6875, MT6877, MT6879, MT6883, MT6885, MT6889, MT6891, MT6893, MT6895, MT6983, MT8321, MT8385, MT8765, MT8766, MT8768, MT8786, MT8788, MT8789, MT8791, MT8791T, MT8797 Affected Software Versions Android 11.0, 12.0, 13.0 CVE CVE-2023-20616 Title Access of resource using incompatible type ('type confusion') in ion Severity Medium Vulnerability Type EoP CWE CWE-843 Access of Resource Using Incompatible Type ('Type Confusion') Description In ion, there is a possible out of bounds read due to type confusion. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Affected Chipsets MT6580, MT6735, MT6737, MT6739, MT6753, MT6757, MT6757C, MT6757CD, MT6757CH, MT6761, MT6762, MT6763, MT6765, MT6768, MT6769, MT6771, MT6779, MT6781, MT6785, MT6833, MT6853, MT6853T, MT6873, MT6875, MT6877, MT6883, MT6885, MT6889, MT6891, MT6893, MT8168, MT8183, MT8321, MT8365, MT8385, MT8666, MT8675, MT8765, MT8766, MT8768, MT8786, MT8788, MT8791T, MT8797 Affected Software Versions Android 11.0, 12.0 CVE CVE-2023-20618 Title Out-of-bounds read in vcu Severity Medium Vulnerability Type EoP CWE CWE-125 Out-of-bounds Read Description In vcu, there is a possible memory corruption due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Affected Chipsets MT6761, MT6762, MT6768, MT6769, MT6779, MT6781, MT6785, MT6789, MT6833, MT6853, MT6853T, MT6873, MT6875, MT6877, MT6883, MT6885, MT6889, MT6891, MT6893, MT8185, MT8786, MT8789, MT8791, MT8797 Affected Software Versions Android 11.0, 12.0, 13.0 CVE CVE-2023-20619 Title Use after free in vcu Severity Medium Vulnerability Type EoP CWE CWE-416 Use After Free Description In vcu, there is a possible memory corruption due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Affected Chipsets MT6761, MT6762, MT6768, MT6769, MT6779, MT6781, MT6785, MT6789, MT6833, MT6853, MT6853T, MT6873, MT6875, MT6877, MT6883, MT6885, MT6889, MT6891, MT6893, MT8185, MT8786, MT8789, MT8791, MT8797 Affected Software Versions Android 11.0, 12.0, 13.0 CVE CVE-2022-32642 Title Improper synchronization in ccd Severity Medium Vulnerability Type EoP CWE CWE-662 Improper Synchronization Description In ccd, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Affected Chipsets MT6879, MT6895, MT6983 Affected Software Versions Android 12.0 CVE CVE-2022-32643 Title Improper synchronization in ccd Severity Medium Vulnerability Type EoP CWE CWE-662 Improper Synchronization Description In ccd, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Affected Chipsets MT6879, MT6895, MT6983 Affected Software Versions Android 12.0 CVE CVE-2022-32654 Title Improper input validation in Wi-Fi driver Severity Medium Vulnerability Type EoP CWE CWE-20 Improper Input Validation Description In Wi-Fi driver, there is a possible undefined behavior due to incorrect error handling. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Affected Chipsets MT5221, MT7603, MT7613, MT7615, MT7622, MT7628, MT7629, MT7663, MT7668, MT7682, MT7686, MT7687, MT7697, MT7902, MT7915, MT7916, MT7921, MT7933, MT7981, MT7986, MT8167S, MT8175, MT8362A, MT8365, MT8385, MT8518S, MT8532, MT8695, MT8696, MT8788 Affected Software Versions 7.6.6.0 CVE CVE-2022-32655 Title Improper input validation in Wi-Fi driver Severity Medium Vulnerability Type EoP CWE CWE-20 Improper Input Validation Description In Wi-Fi driver, there is a possible undefined behavior due to incorrect error handling. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Affected Chipsets MT5221, MT7603, MT7613, MT7615, MT7622, MT7628, MT7629, MT7663, MT7668, MT7682, MT7686, MT7687, MT7697, MT7902, MT7915, MT7916, MT7921, MT7933, MT7981, MT7986, MT8167S, MT8175, MT8362A, MT8365, MT8385, MT8518S, MT8532, MT8695, MT8696, MT8788 Affected Software Versions 7.6.6.0 CVE CVE-2022-32656 Title Improper input validation in Wi-Fi driver Severity Medium Vulnerability Type EoP CWE CWE-20 Improper Input Validation Description In Wi-Fi driver, there is a possible undefined behavior due to incorrect error handling. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Affected Chipsets MT5221, MT7603, MT7613, MT7615, MT7622, MT7628, MT7629, MT7663, MT7668, MT7682, MT7686, MT7687, MT7697, MT7902, MT7915, MT7916, MT7921, MT7933, MT7981, MT7986, MT8167S, MT8175, MT8362A, MT8365, MT8385, MT8518S, MT8532, MT8695, MT8696, MT8788 Affected Software Versions 7.6.6.0 CVE CVE-2022-32663 Title Null pointer dereference in Wi-Fi driver Severity Medium Vulnerability Type DoS CWE CWE-476 NULL Pointer Dereference Description In Wi-Fi driver, there is a possible system crash due to null pointer dereference. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Affected Chipsets MT5221, MT7603, MT7613, MT7615, MT7622, MT7628, MT7629, MT7668, MT7902, MT7915, MT7916, MT7921, MT7981, MT7986, MT8167S, MT8175, MT8362A, MT8365, MT8385, MT8518S, MT8532, MT8788 Affected Software Versions 7.6.6.1 VULNERABILITY TYPE DEFINITION Abbreviation Definition RCE Remote Code Execution EoP Elevation of Privilege ID Information Disclosure DoS Denial of Service N/A Classification not available VERSIONS Version Date Description 1.0 February 6, 2023 Bulletin published. NOTES Information above is generated only at the time of creation of this Security Bulletin. The list of affected chipsets could be not complete. For any further information, device OEMs can reach your MediaTek contact person if needed. If you want to report a security vulnerability in MediaTek chipsets or products, please go to Report Security Vulnerability page on MediaTek website. ABOUT MEDIATEK About Us Office Locations Careers Contact Us NEWS Press Room Blog Media Assets Berita & Media - Indonesia Press Room – ประเทศไทย Tin tức - Việt Nam INVESTOR RELATIONS Financial Information Shareholder Meetings Corporate Governance Investor News Investor Calendar DISCOVER Report Vulnerability MediaTek Foundation MediaTek Ventures JOIN OUR NEWSLETTER SUBMIT Cookie Statement Legal Notice Privacy Policy © 2023 MediaTek Inc. All Rights Reserved Please enable JavaScript