DeutschShown in its original language — a full translation is planned for a future version.
Samsung Android und Samsung Exynos: Mehrere Schwachstellen
view advisory published 2023-05-01
Ein Angreifer kann mehrere Schwachstellen in Samsung Android und Samsung Exynos ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, seine Privilegien zu erweitern und Daten zu manipulieren.
01
describes (21)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-21504US | critical9.8 | — | ||
Potential buffer overflow vulnerability in mm_Plmncoordination.c in Shannon baseband prior to SMR May-2023 Release 1 allows remote attackers to cause invalid memory access. | ||||
| CVE-2023-21503US | critical9.8 | — | ||
Potential buffer overflow vulnerability in mm_LteInterRatManagement.c in Shannon baseband prior to SMR May-2023 Release 1 allows remote attackers to cause invalid memory access. | ||||
| CVE-2023-21502US | high7.8 | — | ||
Improper input validation vulnerability in FactoryTest application prior to SMR May-2023 Release 1 allows local attackers to get privilege escalation via debugging commands. | ||||
| CVE-2023-21501US | high7.8 | — | ||
Improper input validation vulnerability in mPOS fiserve trustlet prior to SMR May-2023 Release 1 allows local attackers to execute arbitrary code. | ||||
| CVE-2023-21500US | medium5.5 | — | ||
Double free validation vulnerability in setPinPadImages in mPOS TUI trustlet prior to SMR May-2023 Release 1 allows local attackers to access the trustlet memory. | ||||
| CVE-2023-21499US | high7.8 | — | ||
Out-of-bounds write vulnerability in TA_Communication_mpos_encrypt_pin in mPOS TUI trustlet prior to SMR May-2023 Release 1 allows local attackers to execute arbitrary code. | ||||
| CVE-2023-21498US | high7.8 | — | ||
Improper input validation vulnerability in setPartnerTAInfo in mPOS TUI trustlet prior to SMR May-2023 Release 1 allows local attackers to overwrite the trustlet memory. | ||||
| CVE-2023-21497US | high7.8 | — | ||
Use of externally-controlled format string vulnerability in mPOS TUI trustlet prior to SMR May-2023 Release 1 allows local attackers to access the memory address. | ||||
| CVE-2023-21496US | medium5.5OT elevated | — | ||
Active Debug Code vulnerability in ActivityManagerService prior to SMR May-2023 Release 1 allows attacker to use debug function via setting debug level. | ||||
| CVE-2023-21495US | medium5.5 | — | ||
Improper access control vulnerability in Knox Enrollment Service prior to SMR May-2023 Release 1 allow attacker install KSP app when device admin is set. | ||||
| CVE-2023-21494US | critical9.8 | — | ||
Potential buffer overflow vulnerability in auth api in mm_Authentication.c in Shannon baseband prior to SMR May-2023 Release 1 allows remote attackers to cause invalid memory acces… | ||||
| CVE-2023-21493US | medium5.5 | — | ||
Improper access control vulnerability in SemShareFileProvider prior to SMR May-2023 Release 1 allows local attackers to access protected data. | ||||
| CVE-2023-21492US | medium4.4OT critical | KEV | ||
Kernel pointers are printed in the log file prior to SMR May-2023 Release 1 allows a privileged local attacker to bypass ASLR. | ||||
| CVE-2023-21491US | high7.8 | — | ||
Improper access control vulnerability in ThemeManager prior to SMR May-2023 Release 1 allows local attackers to write arbitrary files with system privilege. | ||||
| CVE-2023-21490US | high7.1 | — | ||
Improper access control in GearManagerStub prior to SMR May-2023 Release 1 allows a local attacker to delete applications installed by watchmanager. | ||||
| CVE-2023-21489US | medium6.8 | — | ||
Heap out-of-bounds write vulnerability in bootloader prior to SMR May-2023 Release 1 allows a physical attacker to execute arbitrary code. | ||||
| CVE-2023-21488US | high7.8 | — | ||
Improper access control vulnerablility in Tips prior to SMR May-2023 Release 1 allows local attackers to launch arbitrary activity in Tips. | ||||
| CVE-2023-21487US | low3.3 | — | ||
Improper access control vulnerability in Telephony framework prior to SMR May-2023 Release 1 allows local attackers to change a call setting. | ||||
| CVE-2023-21486US | medium4.6 | — | ||
Improper export of android application components vulnerability in ImagePreviewActivity in Call Settings to SMR May-2023 Release 1 allows physical attackers to access some media da… | ||||
| CVE-2023-21485US | medium4.6 | — | ||
Improper export of android application components vulnerability in VideoPreviewActivity in Call Settings to SMR May-2023 Release 1 allows physical attackers to access some media da… | ||||
showing 20 of 21
02
references
External citations — patches, advisories, analysis.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan