November 2023: the bulletin, and what actually shipped
The bulletin lists CVEs. The public security tags carry the code. This page joins the two for Android 14 to 17: which CVEs have a public fix in each major's tags, which do not, and what the tags fix that no bulletin mentions.
At a glance
| Major | CVEs for it | Fixed | Probable | No public code | Security tags this month |
|---|---|---|---|---|---|
| Android 14 | 9 | 9 | 0 | 0 | android-security-14.0.0_r2 |
| Android 15 (pre-release, 15-next) | 0 | 0 | 0 | 0 | none |
| Android 16 (pre-release, 16-next) | 0 | 0 | 0 | 0 | none |
| Android 17 (pre-release, 17-next) | 0 | 0 | 0 | 0 | none |
The bulletin also has 22 vendor and kernel rows (closed-source components, kernel LTS) with no AOSP code to check; they are not counted above.
What this month's security tags add
Each security tag published this month, and the CVEs whose public fix first appears in it. CVEs resolved by an earlier tag are not repeated here; they are in the table above and on each CVE page.
android-security-14.0.0_r2 adds the fix for 9 CVEs: CVE-2023-40100, CVE-2023-40105, CVE-2023-40106, CVE-2023-40107, CVE-2023-40109, CVE-2023-40110, CVE-2023-40111, CVE-2023-40114, CVE-2023-40115.
Announced, with no public code
None this month.
Public before it was announced
None this month.
Fixed, by a probable match
None this month.
Security fixes no advisory mentions
Commits of this month's security tags whose bug ids are in no bulletin and no OSV advisory. Some are likely lower-severity fixes, some may become CVEs later.
android-security-14.0.0_r2 carries a platform update (597 code commits): most of its commits are not security fixes.
Android 14: 264 fixes in android-security-14.0.0_r2
Show the list
Output fake correlation vectors if requested
Remove hardware identity service from TVs
codecs: check client usage flags for decoder
Update barbet SVN to 48
Update barbet SVN to 47
Update barbet SVN to 44
gps: Disable Vzw SUPL OTDOA
Fix layout issue of pattern set up page in F10
thermal: modify emergency and shutdown threshold for VIRTUAL-SKIN
uwb calibration: fix distance range bias
hall_sensor: Disable hall sensor input when bootmode is unknown
update gps sdk 147.20.23.576859
update gps sdk 147.20.23.576052
EGL: Reduce multifile blobcache limit to 32MB
Use version 1 of the DBA service, since version 1 is the only frozen version. bug:289317242 (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:e5e62a21a0c0b02577d6ed0e8f08d7566fc6a384) Merged-In: I770b006b364eb371f4df95f48e2fe5be0c9a9bff Change-Id: I770b006b364eb371f4df95f48e2fe5be0c9a9bff
Update media_codecs_performance_c2.xml for meet device performance
[RESTRICT AUTOMERGE] Increase the com.google.edgetpu.dba service version to 2 in the framework matrix xml
Update SELinux error
uwb: update calibration for range bias
Fix tangorpro_car build file path
uwb: update uwb calibration for T6P
Update default values for metrics flags to enable reporting from public am: 5bf0f68407 am: aa2c59af69 am: 65c6dd0a09 am: 16e7cfbf17 am: d416febde2 am: b0d3d8fd04
Revert "Use proprety_socket_for_system if permissions allow"
Handle symlinks when extracting zipfiles
Handle zip64 extra fields better
Support SBOM generation of m build unbundled APEXs.
Include static libraries information in Android SBOM.
Dist kernel_version.txt
DO NOT MERGE: Enable mainline prebuilts for device targets
Add aosp_arm64_fullmte target
Fix bug when memtag_heap in diag but not sanitizers
cts: Add uwb tests to known failures list
cts-on-gsi: Exclude uwb tests on gsi
verifier: disable report logging in Data Paths
DO NOT MERGE - Remove DataPaths test from CTS-Verifier Test Module List
Fix CTS tests to work when vibration is not supported by device
Restore setTestNameSuffix method to old version
Save and restore display mode for CtsVerifier
Fix time handling problem in DataPaths test. (cp'd from ag/23817828)
Allow CTS-V batching sensor test to pass in "either_mode"
Add null check for testListItem
Call older version UserManager#getUsers prior to U
test_display_p3: Use the colour library instead of ImageCms
Exclude BluetoothMultiDevicesTest in CtsBluetoothMultiDevicesTestCases
ITS: clear unavailable cam event queue @ cam close
Add SharedLibraryInfoTestApp as a data dep to CtsClasspathDeviceInfoTestCases.
Fix remaining reference to "Touch sounds"
Test SpeakerSafe MMAP Datapath
Exclude the odsign_e2e_tests module on cts-on-gsi-exclude.xml
Change the min sdk of helper apps to 29
CtsVerifier: only write one loopback latency result
Fix missing "ave" ReportLog key.
Prompt for ReportLog permissions only for tests that use ReportLog
Update API 34 release config and emulator files for UDC Beta4
protozero: implement string filtering as part of message filtering
RESTRICT AUTOMERGE Roll Skia from d64928640a1b to ae193d0cc7e3 (1 revision)
Hide accurate onFrameRendered calls behind render metrics feature flag
Camera: Fix FD leak
Allow DAP render-only mix to be matched to mmap-ed stream.
Camera: Ensure 'isSlowJpegModeForced' is always initialized
Camera: Add links to mandatory stream combination tables
cameraserver: Fix DYNAMIC_DEPTH / HEIC keys selected for UHR stream configurations.
[SettingsProvider] verify ringtone URI before setting
Fix possible leaks in CanvasContext HintSessionWrapper
Revert "Import translations. DO NOT MERGE ANYWHERE"
Only create InsetsSourceConsumer for InsetsSourceControl
Add a flag byForegroundService to enqueueNotification() call.
Fix large clock flickers when animated in Felix
Change behind-scrim's tint in BOUNCER state to match GM3 surface color.
Fix biometric context update problem.
[Status Bar] Set status bar window insets to status bar height always.
[MediaProjection] Address deadlock between multiple services
Enable insets cache for display switch
Update parcling logic for Uris.
Import translations. DO NOT MERGE ANYWHERE
RingtoneManager: verify default ringtone is audio
DO NOT SUBMIT (Testing Code)
Check for non-interactive dreams when wake and unlocking.
Allow remote input to send intent from background
Consolidate DISABLE_RECENT condition in adjustStatusBarLocked()
Allow system installer to deny update ownership
Remove top margin from dream status bar items
Add comments stating the configs for visible background users are not ready for production
Disable screen wake locks for cached apps
Don't attach pipeline to group expansion mgr.
Fix no KeyguardStatusView on lock screen
Use a single thread executor for calculateHasIncompatibleAccounts
Fix how taskview is used by controlsUi
Handle waking from unlock in KeyguardViewMediator.
Send user activity when dream quits unexpectedly
[pm] do not stop system apps with disabled a launcher activity
Allow additional reason/surface combinations for cancel
Replace ":strings" with "strings"
Wrap the lottie views and trace whenever it invalidates
Clean up postWindowRemoveStartingWindowCleanUp
Update to cold launch if the process is restarted during launching
RESTRICT AUTOMERGE Center align the lock screen wallpaper
Add a failsafe to update surface position after activity-level transit
Disable Clock View Layer and ignore assigned alpha
Avoid sending messages of destroyed Engine
Enable VK_EXT_global_priority
Defer ending launcher power mode hint until after transient transition
Revert "Ignore BIND_ABOVE_CLIENT for same-process connections"
Ensure the getCredentialType cache gets enabled
Add permission check for RemoteTransition in ActivityOptions
Change Ellipse values to old bounding box
Ensure onStop before onPictureInPictureModeChanged
Force Software Rendering for KeyguardClockFrame
Hide alternateBouncer onTrustChanges, not biometricAuth
Make mCurrentPipTaskToken null when app crashes
Do not capture activity snapshot if starting window is associated to task.
Fix for ScrollView absorbing fling stretch
Update lockscreen shortcuts color tokens
Disable memory trimming on AoD and on unlock
Enable the CredentialManager Registry API
Relax policy for non-dismissible calls
Issue scheduleWatchdog command on background thread
Make SDK sandbox BAL check multi-user aware
[Status Bar] Use `defaultDataSubId` flow to trigger config re-fetch.
Fix no AVD transfer to client when using setOnExitAnimationListener
Suppress IndexOutOfBoundsException when cancelling low light animation
Fix inSampleSize != 1 gainmap decoding
Inform the falsing manager about UDFPS touches on down
Add traces around updateZenModeConfig
Prevent lock icon a11y when unlocking.
Synchronize increment of resource cache generations
Send all-window-drawn message of caller directly
Fix media being stretched during the wake-up/unlock animation
[Output Switcher] Allow subtext and flags on System Route
Don't set ImageWallpaper to home only the first time
Fixes bad PIP state when opening Maps from the lock screen
Log plug state chage & other events at boot
[Output Switcher] Allow volume adjustment for Guest
Don't commit invisible on a collecting transient-launch task
Skip user consent popup when sending a personal intent into profile owner app
Call finishedCallback after transitioning away from DREAM
Improve transition between AOD and lockscreen when media is playing for split shade
Handle when sim state indicates that it is absent
Make sure to call back View#onCheckIsTextEditor() on the UI thread
Fix notifications wrong corners after "clear all"
Make PipTransition use animators bounds for unhandled case
Polish home-key from split to pip transition
Fixing constraint of statusIcons in large screen shade header
Put credman registry-based sessions into PENDING state to start
Update thermal related string to support non-phone device
Guard mRearDisplayPendingOverrideRequest with mLock
Avoid fullscreen bounds check while exiting pip
Fix letterbox overlapping with status bar icons after rotating device
[Output Switcher] Fix list order for preference
Do not dismiss priority children of a group being dismissed
Removing some shortcut mappings that didn't make to UDC in system info
Fix small analog clock preview
Fix stalled background thread bug
Add logging for b/280105659
Fix USB power regression when connecting USB headset during phone/voip call.
Skip null surface when validating transition
Set alpha to 1 if not using alpha animation
Add MediaRoute2Info#TYPE_REMOTE_SMARTPHONE
[SettingsProvider] fix notify profile cache for clone-from-parent settings
[res] Preserve the resid order in ThemeKey
Remove vkDeviceWaitIdle call when destroying VulkanSurface
Fix CredDesc reg flow bugs
Fix memory leak of MediaControlPanel
Fix gainmap size for recycled inBitmap in BRD
docs: Fixing typos in Context refdoc
Clear calling identity to grant CDM permission when checking device config.
Reparent PiP overlay under task as soon as possible
Also check PiP activity visibility to determine if enter-pip
Fix volume slider not showing when casting in the background
[MediaProjection] Clarify createVirtualDisplay exception javadoc
Fix javadoc for getPhysicalCameraResults.
Don't create copies of Icon bitmaps for Smartspace
Fix regression in recents animation consumer touchable region
nfc(api): Restore behavior from Android T
Add additional faciliator identifying information
update TelecomManager docs on when to post a CallSytle notif
Consider process proc_state when computing runnableAt.
Apply syncPipSurfaceState synchronously
Revert "ExifInterface: Use FileDescriptors whenever we can."
[MediaProjection] Clarify createVirtualDisplay flags javadoc
Detach CDM transport upon encountering an secure channel error
Add displayid to WindowInfos test wrapper
Reland "Track per-process freezable state in BroadcastQueue."
Trace events while not recording history.
ANDROID 14 -- SPACE PROGRAM -- LAUNCH IMMINENT
Add mAllowInputEvents state to the dump
Avoid refreshing the media output dialog UI while dismissing.
Fix crash opening avatar picker in non-en-US locale.
Add ENABLE_NEW_PRIVACY_DIALOG flag
Keyguard: use transition state for syncing occlude [RESTRICT AUTOMERGE]
[DO NOT MERGE] Increase timeout for UIAutomation
Fix work profile security challenge screen isn't properly shown
Improve updateInputFlinger performance
Lower severity for invalid accessibility hover event stream to ERROR.
RenderEngine: Limit the size of blur input to the display size
UltraHDR: Add Adobe HDR gain map notice
Force HALs to explicitly enable legacy method for clearing buffer caches
Update EGL_GL_COLORSPACE_BT2020_HLG_EXT to the correct value
TouchInputMapper: don't check touchpad touches by screen bounds
Check if current process is visible before contining scans
Refactor BaseWifiTracker.Scanner class to prevent infinite scans
Check mAdnCache is not null before loading FDN.
Return only subscriptions associted with user for work profile.
libhwc2.1: revert behavior of setLayerCompositionType()
Set per-test timeout for IRadio 1.2-1.6 VTS to 5m
Keep existing Pattern.splitAsStream API behavior on Android 13 or below
Don't allow importing contacts to accounts passed in by intent unless it is valid
Fix return condition in getWorkspacePageTranslationProvider
[Unfold animation] Do not preemptively start the animation if it has run already
Log appear animation's scale factor
Disable FOLDABLE_SINGLE_PAGE
Removing obsolete call to start home activity with shell transitions
Fix the issue that on tablet/unfold, the allapps background color is wrong.
Handle onFlingFinished onRecentsAnimationStart
Updating materialColorSurfaceContainerHighest color access
Fix an issue with nav bar translations not being updated
Ignore recents transition if there are no closing tasks
Taskbar All Apps Shortcut Menu Acccessibility Focus
Cleans up bad state when transient taskbar shows on home.
Workaround for handling the restart of an already visible task
Prevent exception when quick switching between two split pairs
Restore strong reference to animation runner
Fix NPE due to invalid RecentsView access
Restore specific colors for floating rotation button
Add detailed exception for snappedIndex == -1 when dismissing tasks
Suspend immersive mode autohide while pending transient taskbar timeout
Add logs to RemoteTargetGluer for index exception
Import translations. DO NOT MERGE ANYWHERE
Trigger talkback for notification volume change
Add content description to volume title in settings.
Fix NPE in updateAddPreference
Fix colors in importance and conversation priority preferences
Update tablet help article link (1/2)
Fix crash of resource not found
Import translations. DO NOT MERGE ANYWHERE
Enabled a11y for clock carousel view
Adds new mappings to content descriptions for custom clock faces
Remove drain_period_ms option from default config
Fixes preview on home/lock tabs when wallpaper is live for both screens
Revert^2 "Fix lock and home screen tab talkback"
Add BootCompletedReceiver in ExtServices that triggers AdServices receiver
[Metrics] Add logging to profile connection attempts
Correct APCF secletion filed for AD type check
Remove unnecessary override of Parcelable.getStability()
Evaluation delay = 8 secs for explicitly selected networks
Never create native network immediately.
Revert "Always disconnect agents immediately."
Have paused keepalives keep their hardware slot
Add a null check for runningAppProcesses.
Add an extra to sharesheet's image edit intent
[uwb] Do not update params when app moved to bg
DO NOT MERGE Add sdk modules list in build artifacts root.
Bump min_sdk_version for all launched apex modules
Fix permission definition for EV_CHARGE_SWITCH.
Hide CAR_INTENT_ACTION_RECEIVER_SERVICE.
Move set speakerphone out of async task executor.
Resolve MT Work Profile ECall
Update swisscomm 144/118 emergency number routing
Correct the flag value for system_server reconnection
libprocessgroup: optimize SetAttributeAction::ExecuteForProcess performance
[zip] Disable mmap after cold launch regression
Regenerate the ART MTS definition (2022-09-22).
vts-exclude: Correctly exclude failing uwb vts tests
Fix padding on EC coordinates that are not expected sizes
Fix analysis AI-generated
For each CVE with a public fix, an analysis of Google's patch: root cause, how the fix works, what it covers and leaves out. Written by a model from the bulletin and the fixing diffs, then checked against the code by a second model. It can still be wrong: verify against the commit.
- CVE-2023-40100 · platform/packages/modules/DnsResolver
Makes Dns64Configuration reference counted (RefBase) and has the detached DNS64 prefix discovery thread capture a strong pointer (sp) to it instead of a raw this, so the object outlives the thread; ResolverController now owns it through android::sp. - CVE-2023-40105 · platform/frameworks/base
Adds a check to ActivityManagerService.backupAgentCreated() that compares the caller's uid with the package's uid, so a caller can only report a backup agent for a package that belongs to its own uid. - CVE-2023-40106 · platform/frameworks/base
Replaces Notification.setAllowlistToken(null) with a new clearAllowlistToken() that also nulls the allowlist token on the nested publicVersion Notification before NotificationManagerService returns an app's own notifications to it. - CVE-2023-40107 · platform/frameworks/av
Adds `mVPSBuf = NULL;` to the single-argument `ARTPWriter::ARTPWriter(int fd)` constructor in media/libstagefright/rtsp/ARTPWriter.cpp. Before this, the VPS buffer pointer was left uninitialised while mSPSBuf and mPPSBuf next to it were already initialised. - CVE-2023-40109 · platform/frameworks/base
UsbConfiguration.CREATOR.createFromParcel now uses the type-safe Parcel.readParcelableArray(ClassLoader, Class) overload with UsbInterface.class, so a non-UsbInterface element in the interfaces array is rejected when a UsbConfiguration is unparceled. - CVE-2023-40110 · platform/frameworks/av
Adds bounds checks against mBufferSize to MtpPacket::getUInt16, getUInt32, putUInt16 and putUInt32 in media/mtp/MtpPacket.cpp, so reads abort and writes are dropped when offset plus field width exceeds the allocated buffer. - CVE-2023-40111 · platform/frameworks/base
The media session service's setMediaButtonReceiver now logs and ignores PendingIntents that target an activity, so a media button receiver can no longer be used to bypass background activity launch restrictions. - CVE-2023-40114 · platform/frameworks/av
Adds a mutex, condition variable and atomic child-thread counter to MtpFfsHandle so that close() waits (up to 2 seconds) for detached doSendEvent threads spawned by sendEvent() to finish before the handle is torn down, preventing a heap use-after-free of the handle's members from the detached thread. - CVE-2023-40115 · platform/packages/modules/StatsD
Replaces the detached log-reader thread spawned in the StatsService constructor with a class-member std::thread. The thread is told to stop (an atomic flag plus a wake-up event pushed into the queue) and joined in the StatsService destructor, so readLogs() can no longer run against a destroyed StatsService.
Bulletin revisions
| Version | Date | Notes |
|---|---|---|
| 1.0 | November 6, 2023 | Bulletin Published |
| 1.1 | November 7, 2023 | Bulletin revised to include AOSP links |
- No change seen since tracking started (2026-09-30).
Method and limits
Fixes are found in the public android-security-* tags by the bug id in the
commit message, then Change-Id and patch id against the bulletin's commit, then two probable
matches checked by content. "No public code" means no fixing commit in the ingested tags of
that major, not proof that no fix exists anywhere. When none of the code the bulletin's
commit patches exists in a major (removed or reworked before its release), the CVE is shown
as "patched code absent" instead. Vendor closed-source components and the kernel are out of
scope.
Data for this page (JSON).