Samsung Mobile
Page 13 of 14 — Samsung Mobile CVEs from a corpus of 1362, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-25492 | High | 7.3 | 2021-10-06 | Lack of boundary checking of a buffer in libSPenBase library of Samsung Notes prior to Samsung Note version 4.3.02.61 allows OOB read. |
CVE-2021-25491 | Low | 2.3 | 2021-10-06 | A vulnerability in mfc driver prior to SMR Oct-2021 Release 1 allows memory corruption via NULL-pointer dereference. |
CVE-2021-25490 | Medium | 6.0 | 2021-10-06 | A keyblob downgrade attack in keymaster prior to SMR Oct-2021 Release 1 allows attacker to trigger IV reuse vulnerability with privileged process. |
CVE-2021-25489 | Low | 3.3 | 2021-10-06 | Assuming radio permission is gained, missing input validation in modem interface driver prior to SMR Oct-2021 Release 1 results in format string bug leading to… |
CVE-2021-25488 | Medium | 5.5 | 2021-10-06 | Lack of boundary checking of a buffer in recv_data() of modem interface driver prior to SMR Oct-2021 Release 1 allows OOB read. |
CVE-2021-25487 | High | 7.3 | 2021-10-06 | Lack of boundary checking of a buffer in set_skb_priv() of modem interface driver prior to SMR Oct-2021 Release 1 allows OOB read and it results in arbitrary c… |
CVE-2021-25486 | Low | 2.5 | 2021-10-06 | Exposure of information vulnerability in ipcdump prior to SMR Oct-2021 Release 1 allows an attacker detect device information via analyzing packet in log. |
CVE-2021-25485 | High | 7.5 | 2021-10-06 | Path traversal vulnerability in FactoryAirCommnadManger prior to SMR Oct-2021 Release 1 allows attackers to write file as system UID via BT remote socket. |
CVE-2021-25484 | Medium | 4.0 | 2021-10-06 | Improper authentication in InputManagerService prior to SMR Oct-2021 Release 1 allows monitoring the touch event. |
CVE-2021-25483 | Medium | 4.0 | 2021-10-06 | Lack of boundary checking of a buffer in livfivextractor library prior to SMR Oct-2021 Release 1 allows OOB read. |
CVE-2021-25482 | Medium | 5.9 | 2021-10-06 | SQL injection vulnerabilities in CMFA framework prior to SMR Oct-2021 Release 1 allow untrusted application to overwrite some CMFA framework information. |
CVE-2021-25481 | Medium | 6.4 | 2021-10-06 | An improper error handling in Exynos CP booting driver prior to SMR Oct-2021 Release 1 allows local attackers to bypass a Secure Memory Protector of Exynos CP… |
CVE-2021-25480 | Medium | 4.4 | 2021-10-06 | A lack of replay attack protection in GUTI REALLOCATION COMMAND message process in Qualcomm modem prior to SMR Oct-2021 Release 1 can lead to remote denial of… |
CVE-2021-25479 | High | 7.2 | 2021-10-06 | A possible heap-based buffer overflow vulnerability in Exynos CP Chipset prior to SMR Oct-2021 Release 1 allows arbitrary memory write and code execution. |
CVE-2021-25478 | High | 7.2 | 2021-10-06 | A possible stack-based buffer overflow vulnerability in Exynos CP Chipset prior to SMR Oct-2021 Release 1 allows arbitrary memory write and code execution. |
CVE-2021-25477 | Medium | 4.4 | 2021-10-06 | An improper error handling in Mediatek RRC Protocol stack prior to SMR Oct-2021 Release 1 allows modem crash and remote denial of service. |
CVE-2021-25476 | Medium | 4.1 | 2021-10-06 | An information disclosure vulnerability in Widevine TA log prior to SMR Oct-2021 Release 1 allows attackers to bypass the ASLR protection mechanism in TEE. |
CVE-2021-25475 | Low | 3.9 | 2021-10-06 | A possible heap-based buffer overflow vulnerability in DSP kernel driver prior to SMR Oct-2021 Release 1 allows arbitrary memory write and code execution. |
CVE-2021-25474 | Medium | 4.4 | 2021-10-06 | Assuming a shell privilege is gained, an improper exception handling for multi_sim_bar_show_on_qspanel value in SystemUI prior to SMR Oct-2021 Release 1 allows… |
CVE-2021-25473 | Medium | 4.4 | 2021-10-06 | Assuming a shell privilege is gained, an improper exception handling for multi_sim_bar_hide_by_meadia_full value in SystemUI prior to SMR Oct-2021 Release 1 al… |
CVE-2021-25472 | Medium | 4.0 | 2021-10-06 | An improper access control vulnerability in BluetoothSettingsProvider prior to SMR Oct-2021 Release 1 allows untrusted application to overwrite some Bluetooth… |
CVE-2021-25471 | Low | 3.7 | 2021-10-06 | A lack of replay attack protection in Security Mode Command process prior to SMR Oct-2021 Release 1 can lead to denial of service on mobile network connection… |
CVE-2021-25470 | High | 7.9 | 2021-10-06 | An improper caller check logic of SMC call in TEEGRIS secure OS prior to SMR Oct-2021 Release 1 can be used to compromise TEE. |
CVE-2021-25469 | Medium | 6.0 | 2021-10-06 | A possible stack-based buffer overflow vulnerability in Widevine trustlet prior to SMR Oct-2021 Release 1 allows arbitrary code execution. |
CVE-2021-25468 | Medium | 4.4 | 2021-10-06 | A possible guessing and confirming a byte memory vulnerability in Widevine trustlet prior to SMR Oct-2021 Release 1 allows attackers to read arbitrary memory a… |
CVE-2021-25467 | Medium | 5.3 | 2021-10-06 | Assuming system privilege is gained, possible buffer overflow vulnerabilities in the Vision DSP kernel driver prior to SMR Oct-2021 Release 1 allows privilege… |
CVE-2021-25466 | Medium | 6.5 | 2021-09-09 | Improper scheme check vulnerability in Samsung Internet prior to version 15.0.2.47 allows attackers to perform Man-in-the-middle attack and obtain Samsung Acco… |
CVE-2021-25465 | Low | 3.3 | 2021-09-09 | An improper scheme check vulnerability in Samsung Themes prior to version 5.2.01 allows attackers to perform Man-in-the-middle attack. |
CVE-2021-25464 | Low | 3.3 | 2021-09-09 | An improper file management vulnerability in SamsungCapture prior to version 4.8.02 allows sensitive information leak. |
CVE-2021-25463 | Medium | 4.0 | 2021-09-09 | Improper access control vulnerability in PENUP prior to version 3.8.00.18 allows arbitrary webpage loading in webview. |
CVE-2021-25462 | Low | 3.3 | 2021-09-09 | NULL pointer dereference vulnerability in NPU driver prior to SMR Sep-2021 Release 1 allows attackers to cause memory corruption. |
CVE-2021-25461 | Medium | 4.0 | 2021-09-09 | An improper length check in APAService prior to SMR Sep-2021 Release 1 results in stack based Buffer Overflow. |
CVE-2021-25460 | Medium | 4.0 | 2021-09-09 | An improper access control vulnerability in sspExit() in BlockchainTZService prior to SMR Sep-2021 Release 1 allows attackers to terminate BlockchainTZService. |
CVE-2021-25459 | Medium | 4.0 | 2021-09-09 | An improper access control vulnerability in sspInit() in BlockchainTZService prior to SMR Sep-2021 Release 1 allows attackers to start BlockchainTZService. |
CVE-2021-25458 | Low | 3.3 | 2021-09-09 | NULL pointer dereference vulnerability in ION driver prior to SMR Sep-2021 Release 1 allows attackers to cause memory corruption. |
CVE-2021-25457 | Medium | 5.9 | 2021-09-09 | An improper input validation vulnerability in DSP driver prior to SMR Sep-2021 Release 1 allows local attackers to get a limited kernel memory information. |
CVE-2021-25456 | Medium | 5.5 | 2021-09-09 | OOB read vulnerability in libswmfextractor.so library prior to SMR Sep-2021 Release 1 allows attackers to execute memcpy at arbitrary address via forged wmf fi… |
CVE-2021-25455 | Low | 3.3 | 2021-09-09 | OOB read vulnerability in libsaviextractor.so library prior to SMR Sep-2021 Release 1 allows attackers to access arbitrary address through pointer via forged a… |
CVE-2021-25454 | Low | 3.1 | 2021-09-09 | OOB read vulnerability in libsaacextractor.so library prior to SMR Sep-2021 Release 1 allows attackers to execute remote DoS via forged aac file. |
CVE-2021-25453 | Medium | 5.1 | 2021-09-09 | Some improper access control in Bluetooth APIs prior to SMR Sep-2021 Release 1 allows untrusted application to get Bluetooth information. |
CVE-2021-25452 | Medium | 5.5 | 2021-09-09 | An improper input validation vulnerability in loading graph file in DSP driver prior to SMR Sep-2021 Release 1 allows attackers to perform permanent denial of… |
CVE-2021-25451 | Low | 3.3 | 2021-09-09 | A PendingIntent hijacking in NetworkPolicyManagerService prior to SMR Sep-2021 Release 1 allows attackers to get IMSI data. |
CVE-2021-25450 | Medium | 4.5 | 2021-09-09 | Path traversal vulnerability in FactoryAirCommnadManger prior to SMR Sep-2021 Release 1 allows attackers to write file as system uid via remote socket. |
CVE-2021-25449 | Medium | 6.5 | 2021-09-09 | An improper input validation vulnerability in libsapeextractor library prior to SMR Sep-2021 Release 1 allows attackers to execute arbitrary code in mediaextra… |
CVE-2021-25448 | Medium | 5.3 | 2021-08-05 | Improper access control vulnerability in Smart Touch Call prior to version 1.0.0.5 allows arbitrary webpage loading in webview. |
CVE-2021-25447 | Medium | 5.3 | 2021-08-05 | Improper access control vulnerability in SmartThings prior to version 1.7.67.25 allows untrusted applications to cause local file inclusion in webview. |
CVE-2021-25446 | Medium | 5.3 | 2021-08-05 | Improper access control vulnerability in SmartThings prior to version 1.7.67.25 allows untrusted applications to cause arbitrary webpage loading in webview. |
CVE-2021-25445 | Medium | 5.3 | 2021-08-05 | Unprotected component vulnerability in Samsung Internet prior to version 14.2 allows untrusted application to access internal files in Samsung Internet. |
CVE-2021-25444 | Medium | 5.5 | 2021-08-05 | An IV reuse vulnerability in keymaster prior to SMR AUG-2021 Release 1 allows decryption of custom keyblob with privileged process. |
CVE-2021-25443 | Medium | 5.3 | 2021-08-05 | A use after free vulnerability in conn_gadget driver prior to SMR AUG-2021 Release 1 allows malicious action by an attacker. |
CVE-2021-25442 | High | 7.5 | 2021-07-08 | Improper MDM policy management vulnerability in KME module prior to KCS version 1.39 allows MDM users to bypass Knox Manage authentication. |
CVE-2021-25441 | High | 7.8 | 2021-07-08 | Improper input validation vulnerability in AR Emoji Editor prior to version 4.4.03.5 in Android Q(10.0) and above allows untrusted applications to access arbit… |
CVE-2021-25440 | High | 7.8 | 2021-07-08 | Improper access control vulnerability in FactoryCameraFB prior to version 3.4.74 allows untrusted applications to access arbitrary files with an escalated priv… |
CVE-2021-25439 | Low | 3.3 | 2021-07-08 | Improper access control vulnerability in Samsung Members prior to versions 2.4.85.11 in Android O(8.1) and below, and 3.9.10.11 in Android P(9.0) and above all… |
CVE-2021-25438 | High | 7.8 | 2021-07-08 | Improper access control vulnerability in Samsung Members prior to versions 2.4.85.11 in Android O(8.1) and below, and 3.9.10.11 in Android P(9.0) and above all… |
CVE-2021-25437 | Critical | 9.8 | 2021-07-08 | Improper access control vulnerability in Tizen FOTA service prior to Firmware update JUL-2021 Release allows attackers to arbitrary code execution by replacing… |
CVE-2021-25436 | Critical | 9.8 | 2021-07-08 | Improper input validation vulnerability in Tizen FOTA service prior to Firmware update JUL-2021 Release allows arbitrary code execution via Samsung Accessory P… |
CVE-2021-25435 | Critical | 9.8 | 2021-07-08 | Improper input validation vulnerability in Tizen bootloader prior to Firmware update JUL-2021 Release allows arbitrary code execution using recovery partition… |
CVE-2021-25434 | Critical | 9.8 | 2021-07-08 | Improper input validation vulnerability in Tizen bootloader prior to Firmware update JUL-2021 Release allows arbitrary code execution using param partition in… |
CVE-2021-25433 | Medium | 5.5 | 2021-07-08 | Improper authorization vulnerability in Tizen factory reset policy prior to Firmware update JUL-2021 Release allows untrusted applications to perform factory r… |
CVE-2021-25432 | Low | 3.3 | 2021-07-08 | Information exposure vulnerability in Samsung Members prior to versions 2.4.85.11 in Android O(8.1) and below, and 3.9.10.11 in Android P(9.0) and above allows… |
CVE-2021-25431 | Medium | 5.5 | 2021-07-08 | Improper access control vulnerability in Cameralyzer prior to versions 3.2.1041 in 3.2.x, 3.3.1040 in 3.3.x, and 3.4.4210 in 3.4.x allows untrusted application… |
CVE-2021-25430 | Medium | 4.3 | 2021-07-08 | Improper access control vulnerability in Bluetooth application prior to SMR July-2021 Release 1 allows untrusted application to access the Bluetooth informatio… |
CVE-2021-25429 | Medium | 4.3 | 2021-07-08 | Improper privilege management vulnerability in Bluetooth application prior to SMR July-2021 Release 1 allows untrusted application to access the Bluetooth info… |
CVE-2021-25428 | High | 7.8 | 2021-07-08 | Improper validation check vulnerability in PackageManager prior to SMR July-2021 Release 1 allows untrusted applications to get dangerous level permission with… |
CVE-2021-25427 | Medium | 6.5 | 2021-07-08 | SQL injection vulnerability in Bluetooth prior to SMR July-2021 Release 1 allows unauthorized access to paired device information |
CVE-2021-25426 | High | 7.5 | 2021-07-08 | Improper component protection vulnerability in SmsViewerActivity of Samsung Message prior to SMR July-2021 Release 1 allows untrusted applications to access Me… |
CVE-2021-25425 | Medium | 5.3 | 2021-06-11 | Improper check vulnerability in Samsung Health prior to version 6.17 allows attacker to read internal cache data via exported component. |
CVE-2021-25424 | High | 8.8 | 2021-06-11 | Improper authentication vulnerability in Tizen bluetooth-frwk prior to Firmware update JUN-2021 Release allows bluetooth attacker to take over the user's bluet… |
CVE-2021-25423 | Medium | 5.5 | 2021-06-11 | Improper log management vulnerability in Watch Active2 PlugIn prior to 2.2.08.21033151 version allows attacker with log permissions to leak Wi-Fi password conn… |
CVE-2021-25422 | Medium | 5.5 | 2021-06-11 | Improper log management vulnerability in Watch Active PlugIn prior to version 2.2.07.21033151 allows attacker with log permissions to leak Wi-Fi password conne… |
CVE-2021-25421 | Medium | 5.5 | 2021-06-11 | Improper log management vulnerability in Galaxy Watch3 PlugIn prior to version 2.2.09.21033151 allows attacker with log permissions to leak Wi-Fi password conn… |
CVE-2021-25420 | Medium | 5.5 | 2021-06-11 | Improper log management vulnerability in Galaxy Watch PlugIn prior to version 2.2.05.21033151 allows attacker with log permissions to leak Wi-Fi password conne… |
CVE-2021-25419 | Medium | 6.5 | 2021-06-11 | Non-compliance of recommended secure coding scheme in Samsung Internet prior to version 14.0.1.62 allows attackers to display fake URL in address bar via phisi… |
CVE-2021-25418 | High | 7.8 | 2021-06-11 | Improper component protection vulnerability in Samsung Internet prior to version 14.0.1.62 allows untrusted applications to execute arbitrary activity in speci… |
CVE-2021-25417 | High | 7.5 | 2021-06-11 | Improper authorization in SDP SDK prior to SMR JUN-2021 Release 1 allows access to internal storage. |
CVE-2021-25416 | Medium | 6.5 | 2021-06-11 | Assuming EL1 is compromised, an improper address validation in RKP prior to SMR JUN-2021 Release 1 allows local attackers to create executable kernel page outs… |
CVE-2021-25415 | Medium | 5.5 | 2021-06-11 | Assuming EL1 is compromised, an improper address validation in RKP prior to SMR JUN-2021 Release 1 allows local attackers to remap EL2 memory as writable. |
CVE-2021-25414 | High | 7.8 | 2021-06-11 | Improper sanitization of incoming intent in Samsung Contacts prior to SMR JUN-2021 Release 1 allows local attackers to copy or overwrite arbitrary files with S… |
CVE-2021-25413 | Medium | 5.5 | 2021-06-11 | Improper sanitization of incoming intent in Samsung Contacts prior to SMR JUN-2021 Release 1 allows local attackers to get permissions to access arbitrary data… |
CVE-2021-25412 | High | 7.8 | 2021-06-11 | An improper access control vulnerability in genericssoservice prior to SMR JUN-2021 Release 1 allows local attackers to execute protected activity with system… |
CVE-2021-25411 | Medium | 4.4 | 2021-06-11 | Improper address validation vulnerability in RKP api prior to SMR JUN-2021 Release 1 allows root privileged local attackers to write read-only kernel memory. |
CVE-2021-25410 | High | 7.1 | 2021-06-11 | Improper access control of a component in CallBGProvider prior to SMR JUN-2021 Release 1 allows local attackers to access arbitrary files with an escalated pri… |
CVE-2021-25409 | Low | 2.4 | 2021-06-11 | Improper access in Notification setting prior to SMR JUN-2021 Release 1 allows physically proximate attackers to set arbitrary notification via physically conf… |
CVE-2021-25408 | High | 7.8 | 2021-06-11 | A possible buffer overflow vulnerability in NPU driver prior to SMR JUN-2021 Release 1 allows arbitrary memory write and code execution. |
CVE-2021-25407 | High | 7.8 | 2021-06-11 | A possible out of bounds write vulnerability in NPU driver prior to SMR JUN-2021 Release 1 allows arbitrary memory write. |
CVE-2021-25406 | Medium | 6.5 | 2021-06-11 | Information exposure vulnerability in Gear S Plugin prior to version 2.2.05.20122441 allows unstrusted applications to access connected BT device information. |
CVE-2021-25405 | Medium | 5.5 | 2021-06-11 | An improper access control vulnerability in ScreenOffActivity in Samsung Notes prior to version 4.2.04.27 allows untrusted applications to access local files. |
CVE-2021-25404 | Low | 3.3 | 2021-06-11 | Information Exposure vulnerability in SmartThings prior to version 1.7.64.21 allows attacker to access user information via log. |
CVE-2021-25403 | Low | 3.3 | 2021-06-11 | Intent redirection vulnerability in Samsung Account prior to version 10.8.0.4 in Android P(9.0) and below, and 12.2.0.9 in Android Q(10.0) and above allows att… |
CVE-2021-25402 | Low | 3.3 | 2021-06-11 | Information Exposure vulnerability in Samsung Notes prior to version 4.2.04.27 allows attacker to access s pen latency information. |
CVE-2021-25401 | High | 7.8 | 2021-06-11 | Intent redirection vulnerability in Samsung Health prior to version 6.16 allows attacker to execute privileged action. |
CVE-2021-25400 | High | 7.8 | 2021-06-11 | Intent redirection vulnerability in Samsung Internet prior to version 14.0.1.20 allows attacker to execute privileged action. |
CVE-2021-25399 | High | 7.1 | 2021-06-11 | Improper configuration in Smart Manager prior to version 11.0.05.0 allows attacker to access the file with system privilege. |
CVE-2021-25398 | Low | 3.3 | 2021-06-11 | Intent redirection vulnerability in Bixby Voice prior to version 3.1.12 allows attacker to access contacts. |
CVE-2021-25397 | Medium | 6.8 | 2021-06-11 | An improper access control vulnerability in TelephonyUI prior to SMR MAY-2021 Release 1 allows local attackers to write arbitrary files of telephony process vi… |
CVE-2021-25396 | Medium | 6.7 | 2021-06-11 | An improper input validation vulnerability in NPU firmware prior to SMR MAY-2021 Release 1 allows arbitrary memory write and code execution. |
CVE-2021-25395 | Medium | 6.4 | 2021-06-11 | A race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows local attackers to bypass signature check given a radio privilege is compromised. |
CVE-2021-25394 | Medium | 6.4 | 2021-06-11 | A use after free vulnerability via race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows arbitrary write given a radio privilege is compr… |
CVE-2021-25393 | Medium | 6.6 | 2021-06-11 | Improper sanitization of incoming intent in SecSettings prior to SMR MAY-2021 Release 1 allows local attackers to get permissions to access system uid data. |