DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Samsung Android: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2025-11-03
Ein Angreifer kann mehrere Schwachstellen in Samsung Android ausnutzen, um möglicherweise beliebigen Code auszuführen, einen Denial-of-Service-Zustand zu verursachen, Daten zu manipulieren oder vertrauliche Informationen offenzulegen.
01
beschreibt (25)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-48595US | —OT kritisch | KEV | ||
In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution p… | ||||
| CVE-2025-48612US | high7.8 | — | ||
In setDefaultKey of DefaultPaymentSettings.java, there is a possible way for an application to set the main user's default NFC payment setting due to improper input validation. Thi… | ||||
| CVE-2025-48604US | medium5.5OT erhöht | — | ||
In multiple locations, there is a possible way to read files from another user due to a missing permission check. This could lead to local information disclosure with no additional… | ||||
| CVE-2025-48603US | medium5.5 | — | ||
In InputMethodInfo of InputMethodInfo.java, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of service with no additiona… | ||||
| CVE-2025-48600US | medium5.5OT erhöht | — | ||
In multiple files, there is a possible way to reveal information across users due to a missing permission check. This could lead to local information disclosure with no additional… | ||||
| CVE-2025-48599US | high7.8OT erhöht | — | ||
In multiple functions of WifiScanModeActivity.java, there is a possible way to bypass a device config restriction due to a missing permission check. This could lead to local escala… | ||||
| CVE-2025-48598US | medium6.6 | — | ||
In multiple locations, there is a possible way to alter the primary user's face unlock settings due to a confused deputy. This could lead to physical escalation of privilege with n… | ||||
| CVE-2025-48597US | high7.8 | — | ||
In multiple locations, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack. This could lead to local escalation of privilege with… | ||||
| CVE-2025-48596US | high7.8 | — | ||
In appendFrom of Parcel.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with no additional execution pri… | ||||
| CVE-2025-48594US | high7.3 | — | ||
In onUidImportance of DisassociationProcessor.java, there is a possible way to retain companion application privileges after disassociation due to improper input validation. This c… | ||||
| CVE-2025-48592US | high7.5 | — | ||
In initDecoder of C2SoftDav1dDec.cpp, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional exec… | ||||
| CVE-2025-48590US | — | — | ||
In verifyAndGetBypass of AppOpsService.java, there is a possible method for a malicious app to prevent dialing emergency services under limited circumstances due to resource exhaus… | ||||
| CVE-2025-48589US | — | — | ||
In multiple functions of HeaderPrivacyIconsController.kt, there is a possible way to grand permissions across user due to a logic error in the code. This could lead to local escal… | ||||
| CVE-2025-48588US | — | — | ||
In startAlwaysOnVpn of Vpn.java, there is a possible way to disable always-on VPN due to a logic error in the code. This could lead to local escalation of privilege with no additio… | ||||
| CVE-2025-48583US | — | — | ||
In multiple functions of BaseBundle.java, there is a possible way to execute arbitrary code due to a logic error in the code. This could lead to local escalation of privilege with… | ||||
| CVE-2025-48575US | —OT erhöht | — | ||
In multiple functions of CertInstaller.java, there is a possible way to install certificates due to a permissions bypass. This could lead to local escalation of privilege with no a… | ||||
| CVE-2025-48525US | — | — | ||
In disassociate of DisassociationProcessor.java, there is a possible way for an app to continue reading notifications when not associated to a companion device due to improper inpu… | ||||
| CVE-2025-22432US | — | — | ||
In notifyTimeout of CallRedirectionProcessor.java, there is a possible persistent connection due to improper input validation. This could lead to local escalation of privilege and… | ||||
| CVE-2025-48593US | — | Exploit | ||
In bta_hf_client_cb_init of bta_hf_client_main.cc, there is a possible remote code execution due to a use after free. This could lead to remote code execution with no additional ex… | ||||
| CVE-2025-20730US | — | Exploit | ||
In preloader, there is a possible escalation of privilege due to an insecure default value. This could lead to local escalation of privilege if a malicious actor has already obtain… | ||||
20 von 25 angezeigt
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan