SB2020070306 - Multiple vulnerabilities in Huawei Mate 30

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2020070306

SB2020070306 - Multiple vulnerabilities in Huawei Mate 30

Published: July 3, 2020

Security Bulletin ID SB2020070306
Severity
Low
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Local access
Highest impact Code execution

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 secuirty vulnerabilities.


1) Use-after-free (CVE-ID: CVE-2020-9263)

The vulnerability allows a local user to compromise vulnerable system.

The vulnerability exists due to a use-after-free error. A local user can trick a victim into running a specially crafted application with common privilege and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


2) Use-after-free (CVE-ID: CVE-2020-9262)

The vulnerability allows a local attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error. A local attacker can trick a victim into running a specially crafted application with high privilege and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


3) Type Confusion (CVE-ID: CVE-2020-9261)

The vulnerability allows a local attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error. A local attacker can trick a victim to install a specially crafted application, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


4) Race condition (CVE-ID: CVE-2020-1839)

The vulnerability allows a local user to execute arbitrary code on the target system.

The vulnerability exists due to a race condition when there is a timing window exists in which certain pointer members can be modified by another process that is operating concurrently. A local administrator can trick a victim into running a specially crafted application with high privilege, exploit the race and execute arbitrary code on the target system.


Remediation

Install update from vendor's website.

References