October 2024: the bulletin, and what actually shipped
The bulletin lists CVEs. The public security tags carry the code. This page joins the two for Android 14 to 17: which CVEs have a public fix in each major's tags, which do not, and what the tags fix that no bulletin mentions.
At a glance
| Major | CVEs for it | Fixed | Probable | No public code | Security tags this month |
|---|---|---|---|---|---|
| Android 14 | 7 | 7 | 0 | 0 | android-security-14.0.0_r13 |
| Android 15 | 0 | 0 | 0 | 0 | none |
| Android 16 (pre-release, 16-next) | 0 | 0 | 0 | 0 | none |
| Android 17 (pre-release, 17-next) | 0 | 0 | 0 | 0 | none |
The bulletin also has 19 vendor and kernel rows (closed-source components, kernel LTS) with no AOSP code to check; they are not counted above.
What this month's security tags add
Each security tag published this month, and the CVEs whose public fix first appears in it. CVEs resolved by an earlier tag are not repeated here; they are in the table above and on each CVE page.
android-security-14.0.0_r13 adds the fix for 7 CVEs: CVE-2024-0044, CVE-2024-40672, CVE-2024-40673, CVE-2024-40674, CVE-2024-40675, CVE-2024-40676, CVE-2024-40677.
Announced, with no public code
None this month.
Public before it was announced
None this month.
Fixed, by a probable match
None this month.
Security fixes no advisory mentions
Commits of this month's security tags whose bug ids are in no bulletin and no OSV advisory. Some are likely lower-severity fixes, some may become CVEs later.
No security tag this month.
Fix analysis AI-generated
For each CVE with a public fix, an analysis of Google's patch: root cause, how the fix works, what it covers and leaves out. Written by a model from the bulletin and the fixing diffs, then checked against the code by a second model. It can still be wrong: verify against the commit.
- CVE-2024-0044 · platform/frameworks/base
PackageInstallerService session creation now rejects (nulls out) app and installer package names that are over-long or contain characters not accepted by FrameworkParsingPackageUtils.validateName, instead of only checking their length. - CVE-2024-40672 · platform/packages/modules/IntentResolver
ChooserActivity.onCreate in the IntentResolver module now reads Settings.Global.SECURE_FRP_MODE and, when it is 1, logs, calls super.onCreate and immediately finishes, so the share sheet cannot be launched while Factory Reset Protection enforcement is active. - CVE-2024-40673 · platform/libcore
libcore's native ZipFile open path (ZIP_Put_In_Cache0 in ojluni/src/main/native/zip_util.c) now rejects any zip file whose first 4 bytes are neither a local file header signature (LOCSIG) nor an end-of-central-directory signature (ENDSIG). This aligns java.util.ZipFile with libziparchive except for empty archives. - CVE-2024-40674 · platform/packages/modules/Wifi
Adds a maximum length check (32 characters plus the two enclosing quotes) for quoted plaintext SSIDs in WifiConfigurationUtil.validateSsid, which previously only length-checked unquoted hex SSIDs. - CVE-2024-40675 · platform/frameworks/base
Intent.parseUri now throws URISyntaxException("uri end not found") when a name=value field in the new-format Intent URI loop has no ';' after it, instead of continuing with semi == -1. - CVE-2024-40676 · platform/frameworks/base
AccountManagerService.checkKeyIntent now rejects authenticator-supplied KEY_INTENT Intents whose data URI scheme is "content", returning false before the resolved activity is accepted. - CVE-2024-40677 · platform/packages/apps/Settings
The Settings fragment AdvancedPowerUsageDetail (App battery usage detail page) now overrides shouldSkipForInitialSUW() to return true, so the page is not allowed to launch before the setup flow completes. This is described as an FRP bypass defense.
Bulletin revisions
| Version | Date | Notes |
|---|---|---|
| 1.0 | October 7, 2024 | Bulletin Published. |
- No change seen since tracking started (2026-09-30).
Method and limits
Fixes are found in the public android-security-* tags by the bug id in the
commit message, then Change-Id and patch id against the bulletin's commit, then two probable
matches checked by content. "No public code" means no fixing commit in the ingested tags of
that major, not proof that no fix exists anywhere. When none of the code the bulletin's
commit patches exists in a major (removed or reworked before its release), the CVE is shown
as "patched code absent" instead. Vendor closed-source components and the kernel are out of
scope.
Data for this page (JSON).