DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Samsung Android: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2025-07-07
Ein lokaler Angreifer kann mehrere Schwachstellen in Samsung Android ausnutzen, um seine Privilegien zu erhöhen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen preiszugeben oder einen Denial-of-Service-Zustand zu verursachen.
01
beschreibt (33)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-32331US | high7.8 | — | ||
In showDismissibleKeyguard of KeyguardService.java, there is a possible way to bypass app pinning due to a logic error in the code. This could lead to local escalation of privilege… | ||||
| CVE-2025-32330US | —OT erhöht | — | ||
In generateRandomPassword of LocalBluetoothLeBroadcast.java, there is a possible way to intercept the Auracast audio stream due to an insecure default value. This could lead to rem… | ||||
| CVE-2025-32326US | — | — | ||
In multiple functions of AppRestrictionsFragment.java, there is a possible way to bypass intent security check due to a confused deputy. This could lead to local escalation of pri… | ||||
| CVE-2025-32325US | — | — | ||
In appendFrom of Parcel.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution pr… | ||||
| CVE-2025-32321US | — | — | ||
In isSafeIntent of AccountTypePreferenceLoader.java, there is a possible way to bypass an intent type check due to a confused deputy. This could lead to local escalation of privile… | ||||
| CVE-2025-26454US | — | — | ||
In validateUriSchemeAndPermission of DisclaimersParserImpl.java , there is a possible way to access data from another user due to a confused deputy. This could lead to local escala… | ||||
| CVE-2024-49714US | — | — | ||
In avrc_vendor_msg of avrc_opt.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to paired device escalation of privilege with no additiona… | ||||
| CVE-2025-27061US | — | — | ||
Memory corruption whhile handling the subsystem failure memory during the parsing of video packets received from the video firmware. | ||||
| CVE-2025-27057US | — | — | ||
Transient DOS while handling beacon frames with invalid IE header length. | ||||
| CVE-2025-27056US | — | — | ||
Memory corruption during sub-system restart while processing clean-up to free up resources. | ||||
| CVE-2025-27052US | — | — | ||
Memory corruption while processing data packets in diag received from Unix clients. | ||||
| CVE-2025-27043US | — | — | ||
Memory corruption while processing manipulated payload in video firmware. | ||||
| CVE-2025-27042US | — | — | ||
Memory corruption while processing video packets received from video firmware. | ||||
| CVE-2025-21450US | —OT erhöht | — | ||
Cryptographic issue occurs due to use of insecure connection method while downloading. | ||||
| CVE-2025-21449US | — | — | ||
Transient DOS may occur while processing malformed length field in SSID IEs. | ||||
| CVE-2025-21446US | — | — | ||
Transient DOS may occur when processing vendor-specific information elements while parsing a WLAN frame for BTM requests. | ||||
| CVE-2025-21433US | medium5.5 | — | ||
Transient DOS when importing a PKCS#8-encoded RSA private key with a zero-sized modulus. | ||||
| CVE-2025-21004US | medium5.5 | — | ||
Improper verification of intent by broadcast receiver in System UI for Galaxy Watch prior to SMR Jul-2025 Release 1 allows local attackers to power off the device. | ||||
| CVE-2025-21003US | medium5.5 | — | ||
Insecure storage of sensitive information in Emergency SOS prior to SMR Jul-2025 Release 1 allows local attackers to access sensitive information. | ||||
| CVE-2025-21002US | medium5.5 | — | ||
Improper access control in LeAudioService prior to SMR Jul-2025 Release 1 allows local attackers to manipulate broadcasting Auracast. | ||||
20 von 33 angezeigt
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan