SB2016111108 - Multiple vulnerabilities in Samsung Mobile

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2016111108

SB2016111108 - Multiple vulnerabilities in Samsung Mobile

Published: November 11, 2016 Updated: August 9, 2020

Security Bulletin ID SB2016111108
Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 33% Low 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Race condition (CVE-ID: CVE-2015-7891)

The vulnerability allows a local authenticated user to execute arbitrary code.

Race condition in the ioctl implementation in the Samsung Graphics 2D driver (aka /dev/fimg2d) in Samsung devices with Android L(5.0/5.1) allows local users to trigger memory errors by leveraging definition of g2d_lock and g2d_unlock lock macros as no-ops, aka SVE-2015-4598.


2) Input validation error (CVE-ID: CVE-2016-4546)

The vulnerability allows a local authenticated user to perform a denial of service (DoS) attack.

Samsung devices with Android KK(4.4) or L(5.0/5.1) allow local users to cause a denial of service (IAndroidShm service crash) via crafted data in a service call.


3) Integer overflow (CVE-ID: CVE-2016-9277)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

Integer overflow in SystemUI in KK(4.4) and L(5.0/5.1) on Samsung Note devices allows attackers to cause a denial of service (UI restart) via vectors involving APIs and an activity that computes an out-of-bounds array index, aka SVE-2016-6906.


Remediation

Install update from vendor's website.

References