Multiple security vulnerabilities have been disclosed in various applications and system components within Xiaomi devices running Android.
“The vulnerabilities in Xiaomi led to access to arbitrary activities, receivers and services with system privileges, theft of arbitrary files with system privileges, [and] disclosure of phone, settings and Xiaomi account data,” mobile security firm Oversecured said in a report shared with The Hacker News.
The 20 shortcomings impact different apps and components like –
Also discovered is a memory corruption flaw impacting the GetApps app, which, in turn, originates from an Android library called LiveEventBus that Oversecured said was reported to the project maintainers over a year ago and remains unpatched to date.
The Mi Video app has been found to use implicit intents to send Xiaomi account information, such as username and email address via broadcasts, which could be intercepted by any third-party app installed on the devices using its own broadcast receivers.
Source: https://thehackernews.com/
