Summary
Ein Angreifer kann mehrere Schwachstellen in Samsung Android ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen, beliebigen Code mit Privilegien auszuführen, vertrauliche Informationen preiszugeben, Sicherheitsmaßnahmen zu umgehen oder Dateien zu manipulieren.
Product
Das Android Betriebssystem ist eine quelloffene Plattform für mobile Geräte. Die Basis bildet der Linux-Kernel.
Vulnerabilities 44
-
Critical 9.8
In gatts_process_read_by_type_req of gatt_sr.cc, there is a possible out of bounds write due to a logic error in the co…
-
Critical 9.8
In gatts_process_primary_service_req of gatt_sr.cc, there is a possible out of bounds write due to a heap buffer overfl…
-
High 8.8
In build_read_multi_rsp of gatt_sr.cc, there is a possible out of bounds write due to a missing bounds check. This coul…
-
High 8.8
In gatts_process_find_info of gatt_sr.cc, there is a possible out of bounds write due to a missing bounds check. This c…
-
High 8.8
In gatts_process_read_req of gatt_sr.cc, there is a possible out of bounds write due to a missing bounds check. This co…
-
High 8.8
In DGifSlurp of dgif_lib.c, there is a possible out of bounds write due to an integer overflow. This could lead to remo…
-
High 8.4
Improper Validation of Array Index in Hypervisor
Memory corruption while Configuring the SMR/S2CR register in Bypass mode.
-
High 8.4
Buffer Over-read in MProc
Memory corruption when allocating and accessing an entry in an SMEM partition continuously.
-
High 7.8
In setActualDefaultRingtoneUri of RingtoneManager.java, there is a possible way to bypass content providers read permis…
-
High 7.8
In multiple locations, there is a possible bypass of user consent to enabling new Bluetooth HIDs due to a logic error i…
-
High 7.8
Stack-based Buffer Overflow in Performance
Memory corruption when invalid input is passed to invoke GPU Headroom API call.
-
High 7.8
Improper Input Validation in Video Analytics and Processing
Memory corruption while processing API calls to NPU with invalid input.
-
High 7.8
In DevmemValidateFlags of devicemem_server.c , there is a possible out of bounds write due to memory corruption. This c…
-
High 7.8
In multiple locations, there is a possible way to obtain any system permission due to a logic error in the code. This c…
-
High 7.8
GPU DDK - PowerVR: TLB invalidate UAF of dma_buf imported into multiple GPU devices
Software installed and run as a non-privileged user may conduct GPU system calls to read and write freed physical memory from the GPU.
-
High 7.8
In multiple locations, there is a possible way to obtain access to a folder due to a tapjacking/overlay attack. This co…
-
High 7.8
In multiple functions of CompanionDeviceManagerService.java, there is a possible way to grant permissions without user …
-
High 7.8
In multiple locations, there is a possible failure to persist permissions settings due to resource exhaustion. This cou…
-
High 7.8
In applyTaskFragmentOperation of WindowOrganizerController.java, there is a possible way to launch arbitrary activities…
-
High 7.8
In writeInplace of Parcel.cpp, there is a possible out of bounds write. This could lead to local escalation of privileg…
-
High 7.8
In onCreate of NotificationAccessConfirmationActivity.java , there is a possible way to hide an app with notification a…
-
High 7.8
In checkKeyIntentParceledCorrectly of AccountManagerService.java, there is a possible way to bypass parcel mismatch mit…
-
High 7.8
In growData of Parcel.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to…
-
High 7.5
Integer Overflow or Wraparound in WLAN Host Communication
Transient DOS while parsing the ML IE when a beacon with common info length of the ML IE greater than the ML IE inside which this element is present.
-
High 7.5
In multiple functions of ConnectivityService.java, there is a possible way for a Wi-Fi AP to determine what site a devi…
-
High 7.4
In smp_proc_rand of smp_act.cc, there is a possible authentication bypass during legacy BLE pairing due to incorrect im…
-
High 7.0
Out-of-bounds write in accessing buffer storing the decoded video frames in libsthmbc.so prior to SMR Jan-2025 Release …
-
High 7.0
Out-of-bounds write in accessing uninitialized memory for svc1td in libsthmbc.so prior to SMR Jan-2025 Release 1 allows…
-
High 7.0
Out-of-bounds write in handling the block size for smp4vtd in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local…
-
High 7.0
Out-of-bounds write in decoding frame buffer in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attackers to …
-
Medium 6.7
In vdec, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of …
-
Medium 6.5
In build_read_multi_rsp of gatt_sr.cc, there is a possible denial of service due to a logic error in the code. This cou…
-
Medium 6.4
Out-of-bounds write in softsim trustlet prior to SMR Jan-2025 Release 1 allows local privileged attackers to cause memo…
-
Medium 5.9
Protection Mechanism Failure in bootloader prior to SMR Jan-2025 Release 1 allows physical attackers to allow to execut…
-
Medium 5.5
In multiple locations, there is a possible way to access media content belonging to another user due to a missing permi…
-
Medium 5.5
In reload of ServiceListing.java , there is a possible way to allow a malicious app to hide an NLS from Settings due to…
-
Medium 5.5
In onClick of MainClear.java, there is a possible way to trigger factory reset without explicit user consent due to a l…
-
Medium 5.3
Out-of-bounds read in accessing table used for svp8t in libsthmbc.so prior to SMR Jan-2025 Release 1 allows local attac…
-
Medium 5.3
Out-of-bounds read in decoding malformed bitstream for smp4vtd in libsthmbc.so prior to SMR Jan-2025 Release 1 allows l…
-
Medium 5.3
Out-of-bounds read in decoding malformed bitstream of video thumbnails in libsthmbc.so prior to SMR Jan-2025 Release 1 …
-
Medium 5.1
Improper access control in NotificationManager prior to SMR Jan-2025 Release 1 allows local attackers to change the con…
-
Medium 4.6
Improper access control in SoundPicker prior to SMR Jan-2025 Release 1 allows physical attackers to access data across …
-
Medium 4.6
Improper access control in Samsung Message prior to SMR Jan-2025 Release 1 allows physical attackers to access data acr…
-
Medium 4.1
Inclusion of sensitive information in test code in softsim trustlet prior to SMR Jan-2025 Release 1 allows local privil…
Revision history
-
#1
Initiale Fassung
References
-
Samsung Security Update vom 2025-01-06
https://security.samsungmobile.com/securityUpdate.smsb