SB2022022103 - Multiple vulnerabilities in Samsung Galaxy S21

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Open redirect (CVE-ID: N/A)

The vulnerability allows a remote attacker to redirect victims to arbitrary URL.

The vulnerability exists due to improper sanitization of user-supplied data within the Galaxy Store. A remote attacker can create a link that leads to a trusted website, however, when clicked, redirects the victim to arbitrary domain, leading to remote code execution.

2) Error Handling (CVE-ID: N/A)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper handling of errors when accessing trusted URLs. A remote attacker on the local network can trick a victim to visit a malicious page or open a specially crafted file and execute arbitrary code on the target system.

Remediation

Install update from vendor's website.

References

• https://www.zerodayinitiative.com/advisories/ZDI-22-379/
• https://www.zerodayinitiative.com/advisories/ZDI-22-380/