Medium WID-SEC-2023-1344 10 CVEs

Samsung Android: Mehrere Schwachstellen

Published May 31, 2023 · Updated May 31, 2023 · de-DE

Vendor: Samsung Product: Android Product: Android Blockchain Keystore < 1.3.12.1 Product: Android Core Service < 2.1.00.36 Product: Android Galaxy S22 Platform: Android

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Samsung Android Apps und den S22 Modellen ausnutzen, um beliebigen Programmcode auszuführen, Informationen offenzulegen oder Sicherheitsvorkehrungen zu umgehen.

Product

Das Android Betriebssystem ist eine quelloffene Plattform für mobile Geräte. Die Basis bildet der Linux-Kernel.

Vulnerabilities 10

High 7.5

CVE-2023-21514

Improper scheme validation from InstantPlay Deeplink in Galaxy Store prior to version 4.5.49.8 allows attackers to exec…

Samsung Mobile Galaxy Store

May 26, 2023
High 7.5

CVE-2023-21515

InstantPlay which included vulnerable script which could execute javascript in Galaxy Store prior to version 4.5.49.8 a…

Samsung Mobile Galaxy Store

May 26, 2023
High 7.5

CVE-2023-21516

XSS vulnerability from InstantPlay in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript API…

Samsung Mobile Galaxy Store

May 26, 2023
Medium 6.7

CVE-2023-21506

Out-of-bounds Write vulnerability while processing BC_TUI_CMD_SEND_RESOURCE_DATA_ARRAY command in bc_tui trustlet from …

Samsung Mobile Samsung Blockchain Keystore

May 4, 2023
Medium 6.7

CVE-2023-21508

Out-of-bounds Write vulnerability while processing BC_TUI_CMD_SEND_RESOURCE_DATA command in bc_tui trustlet from Samsun…

Samsung Mobile Samsung Blockchain Keystore

May 4, 2023
Medium 6.7

CVE-2023-21509

Out-of-bounds Write vulnerability while processing BC_TUI_CMD_UPDATE_SCREEN in bc_tui trustlet from Samsung Blockchain …

Samsung Mobile Samsung Blockchain Keystore

May 4, 2023
Medium 4.4

CVE-2023-21507

Out-of-bounds Read vulnerability while processing BC_TUI_CMD_SEND_RESOURCE_DATA_ARRAY command in bc_tui trustlet from S…

Samsung Mobile Samsung Blockchain Keystore

May 4, 2023
Medium 4.4

CVE-2023-21510

Out-of-bounds Read vulnerability while processing BC_TUI_CMD_UPDATE_SCREEN in bc_tui trustlet from Samsung Blockchain K…

Samsung Mobile Samsung Blockchain Keystore

May 4, 2023
Medium 4.4

CVE-2023-21511

Out-of-bounds Read vulnerability while processing CMD_COLDWALLET_BTC_SET_PRV_UTXO in bc_core trustlet from Samsung Bloc…

Samsung Mobile Samsung Blockchain Keystore

May 4, 2023
Medium 4.0

CVE-2023-21505

Improper access control in Samsung Core Service prior to version 2.1.00.36 allows attacker to write arbitrary file in s…

Samsung Mobile Samsung Core Service

May 4, 2023

Revision history

2023-05-31 #1
Initiale Fassung

References

ZDI Advisory vom 2023-05-31
https://www.zerodayinitiative.com/advisories/ZDI-23-774/
ZDI Advisory vom 2023-05-31
https://www.zerodayinitiative.com/advisories/ZDI-23-772/
ZDI Advisory vom 2023-05-31
https://www.zerodayinitiative.com/advisories/ZDI-23-773/
SamsungMobile Android Applications Updates vom 2023-05-31
https://security.samsungmobile.com/serviceWeb.smsb