An out-of-bound read vulnerability was patched with proper boundary check logic. An improper input validation vulnerability in TelephonyUI that would allow attackers to configure “Preferred Call” was fixed, and the patch removed unused code.
A hardcoded encryption key vulnerability in NFC was fixed by adding proper usage of random private key API to prevent key exposure. And an improper access control vulnerability in telecom applications was fixed with access control logic to prevent sensitive information leaks.
The January 2023 security patch also fixes a Knox Service vulnerability concerning Permissions or Privileges. The patch also adds restrictions that lock the Secure Folder container when PIP is closed. In other words, the vulnerability allowed the Secure Folder container to remain unlocked under certain conditions.
