Summary
Ein lokaler Angreifer kann mehrere Schwachstellen in Samsung Android ausnutzen, um seine Privilegien zu erhöhen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen preiszugeben oder einen Denial-of-Service-Zustand zu verursachen.
Product
Das Android Betriebssystem ist eine quelloffene Plattform für mobile Geräte. Die Basis bildet der Linux-Kernel.
Vulnerabilities 33
-
Critical 9.1
Improper Authentication in GPS_GNSS
Cryptographic issue occurs due to use of insecure connection method while downloading.
-
Critical 9.1
In RRC in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1…
-
High 8.4
In multiple locations, there is a possible way to trick a user into disclosing Autofill contents due to a tapjacking/ov…
-
High 8.4
In multiple locations, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay …
-
High 7.8
In avrc_vendor_msg of avrc_opt.cc, there is a possible out of bounds write due to a heap buffer overflow. This could le…
-
High 7.8
Improper Access Control in Core
Memory corruption may occur while attaching VM when the HLOS retains access to VM.
-
High 7.8
Mali GPU Kernel Driver allows access to already freed memory
Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform valid GPU memory processing operations to gain acces…
-
High 7.8
In validateUriSchemeAndPermission of DisclaimersParserImpl.java , there is a possible way to access data from another u…
-
High 7.8
Incorrect Calculation of Buffer Size in Video
Memory corruption while processing video packets received from video firmware.
-
High 7.8
Buffer Copy Without Checking Size of Input in Video
Memory corruption while processing manipulated payload in video firmware.
-
High 7.8
Buffer Copy Without Checking Size of Input in Core Services
Memory corruption while processing data packets in diag received from Unix clients.
-
High 7.8
Use After Free in DSP Service
Memory corruption during sub-system restart while processing clean-up to free up resources.
-
High 7.8
Out-of-bounds Write in Video
Memory corruption whhile handling the subsystem failure memory during the parsing of video packets received from the video firmware.
-
High 7.8
In isSafeIntent of AccountTypePreferenceLoader.java, there is a possible way to bypass an intent type check due to a co…
-
High 7.8
In appendFrom of Parcel.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to …
-
High 7.8
In multiple functions of AppRestrictionsFragment.java, there is a possible way to bypass intent security check due to a…
-
High 7.8
In showDismissibleKeyguard of KeyguardService.java, there is a possible way to bypass app pinning due to a logic error …
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS may occur when processing vendor-specific information elements while parsing a WLAN frame for BTM requests.
-
High 7.5
Buffer Over-read in WLAN Embedded SW
Transient DOS may occur while processing malformed length field in SSID IEs.
-
High 7.5
Buffer Over-read in WLAN Host
Transient DOS while handling beacon frames with invalid IE header length.
-
Medium 6.4
Bluetooth BR/EDR devices with Secure Simple Pairing and Secure Connections pairing in Bluetooth Core Specification 4.2 …
-
Medium 6.4
Out-of-bounds write in setting auth secret in KnoxVault trustlet prior to SMR Jul-2025 Release 1 allows local privilege…
-
Medium 6.4
Out-of-bounds write in checking auth secret in KnoxVault trustlet prior to SMR Jul-2025 Release 1 allows local privileg…
-
Medium 6.2
Incorrect default permission in Framework for Galaxy Watch prior to SMR Jul-2025 Release 1 allows local attackers to re…
-
Medium 6.2
Improper privilege management in Bluetooth prior to SMR Jul-2025 Release 1 allows local attackers to enable Bluetooth.
-
Medium 6.2
Improper access control in LeAudioService prior to SMR Jul-2025 Release 1 allows local attackers to stop broadcasting A…
-
Medium 6.2
Improper access control in LeAudioService prior to SMR Jul-2025 Release 1 allows local attackers to manipulate broadcas…
-
Medium 6.2
Improper verification of intent by broadcast receiver in System UI for Galaxy Watch prior to SMR Jul-2025 Release 1 all…
-
Medium 6.2
NULL Pointer Dereference in SPS-HLOS
Transient DOS when importing a PKCS#8-encoded RSA private key with a zero-sized modulus.
-
Medium 5.7
In generateRandomPassword of LocalBluetoothLeBroadcast.java, there is a possible way to intercept the Auracast audio st…
-
Medium 5.5
Improper access control in SamsungAccount for Galaxy Watch prior to SMR Jul-2025 Release 1 allows local attackers to ac…
-
Medium 4.1
Improper authorization in accessing saved Wi-Fi password for Galaxy Tablet prior to SMR Jul-2025 Release 1 allows secon…
-
Medium 4.0
Insecure storage of sensitive information in Emergency SOS prior to SMR Jul-2025 Release 1 allows local attackers to ac…
Revision history
-
#3
Referenz(en) aufgenommen: EUVD-2025-211241, EUVD-2025-211242
-
#2
Referenz(en) aufgenommen: EUVD-2024-54966, EUVD-2025-26842, EUVD-2025-26844, EUVD-2025-26835, EUVD-2025-26836, EUVD-2025-26839, EUVD-2025-26838
-
#1
Initiale Fassung
References
-
Samsung Security Updates vom 2025-07-07
https://security.samsungmobile.com/securityUpdate.smsb