{"hash": "5cc61babb0c77709388a41b3ee26f6afbc5a2bc8ca46bc8f16b237ea51a3d501", "id": "HUAWEI-SA-20160104-04-SMARTPHONE", "lastseen": "2016-09-05T13:35:33", "viewCount": 0, "hashmap": [{"hash": "adc20640f5d3f85de3d992bac1f1d97b", "key": "affectedSoftware"}, {"hash": "f9fa10ba956cacf91d7878861139efb9", "key": "bulletinFamily"}, {"hash": "3eafe543cf50c5c4eede0cf9248c3b7d", "key": "cvelist"}, {"hash": "2076413bdcb42307d016f5286cbae795", "key": "cvss"}, {"hash": "9ebbd8666de70f77a70af95d1a7206f1", "key": "description"}, {"hash": "a3d5d869dcf8d20ffd88a7139b8fef47", "key": "href"}, {"hash": "fa98f25b9e6fe6ff5ed25f04c6f7a7f4", "key": "modified"}, {"hash": "777d45bbbcdf50d49c42c70ad7acf5fe", "key": "objectVersion"}, {"hash": "23c63087456635d9626c44ad881f978e", "key": "published"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "1fe6f9c53ed1ec89833f87f45ee6db6f", "key": "reporter"}, {"hash": "c9e5eac2e657b0ddb9c561ed74093d12", "key": "title"}, {"hash": "c1aafc7e23f24ba11aae492f5caa2d97", "key": "type"}], "bulletinFamily": "software", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "edition": 1, "enchantments": {"vulnersScore": 9.3}, "type": "huawei", "description": "There are multiple security vulnerabilities in driver of some Huawei smart phones.\nThere are two interface access control vulnerabilities in Graphics driver. An attacker may trick a user into installing a malicious application and application can exploit the vulnerability to crash the system or escalate user privilege. (Vulnerability ID: HWPSIRT-2015-11010 and HWPSIRT-2015-11091)\nThe vulnerability HWPSIRT-2015-11010 has been assigned Common Vulnerabilities and Exposures (CVE) ID: CVE-2015-8307, the vulnerability HWPSIRT-2015-11091 has been assigned CVE ID: CVE-2015-8680.\nThere are two heap overflow vulnerabilities in HIFI driver. An attacker may trick a user into installing a malicious application and the application can send given parameter to HIFI driver to crash the system or escalate user privilege. (Vulnerability ID: HWPSIRT-2015-11028 and HWPSIRT-2015-11029)\nThe vulnerability HWPSIRT-2015-11028 has been assigned CVE ID: CVE-2015-8318, the vulnerability HWPSIRT-2015-11029 has been assigned CVE ID: CVE-2015-8319.\nThere is a interface access control vulnerability in ovisp driver. An attacker may trick a user into installing a malicious application and application can exploit the vulnerability to crash the system or escalate user privilege. (Vulnerability ID: HWPSIRT-2015-12003)\nThis vulnerability has been assigned CVE ID: CVE-2015-8681.\nHuawei has released software updates to fix those vulnerabilities. This advisory is available at the following link: \nhttp://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160104-04-smartphone-en", "title": "Security Advisory - Multiple Security Vulnerabilities in Driver of Huawei Smart Phones", "history": [], "objectVersion": "1.2", "cvelist": ["CVE-2015-8680", "CVE-2015-8307", "CVE-2015-8319", "CVE-2015-8318", "CVE-2015-8681"], "published": "2016-01-04T00:00:00", "references": [], "reporter": "Huawei Technologies", "affectedSoftware": [{"version": "GRA-CL10C92B220 and earlier versions", "name": "P8", "operator": "eq"}, {"version": "CRR-CL00C92B153 and earlier versions", "name": "Mate S", "operator": "eq"}, {"version": "CRR-UL00C00B153 and earlier versions", "name": "Mate S", "operator": "eq"}, {"version": "GRA-TL00C01B220 and earlier versions", "name": "P8", "operator": "eq"}, {"version": "GRA-UL00C00B220 and earlier versions", "name": "P8", "operator": "eq"}, {"version": "GRA-UL10C00B220 and earlier versions", "name": "P8", "operator": "eq"}, {"version": "GRA-CL00C92B220 and earlier versions", "name": "P8", "operator": "eq"}, {"version": "CRR-TL00C01B153SP01 and earlier versions", "name": "Mate S", "operator": "eq"}], "modified": "2016-02-03T00:00:00", "href": "http://www.huawei.com/en/psirt/security-advisories/2016/huawei-sa-20160104-04-smartphone-en"}

{"result": {"cve": [{"id": "CVE-2015-8680", "type": "cve", "title": "CVE-2015-8680", "description": "The Graphics driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, GRA-UL00 before GRA-UL00C00B230, and GRA-UL10 before GRA-UL10C00B230, and Mate S smartphones with software CRR-TL00 before CRR-TL00C01B160SP01, CRR-UL00 before CRR-UL00C00B160, and CRR-CL00 before CRR-CL00C92B161 allows attackers to cause a denial of service (system crash) or gain privileges via a crafted application with the graphics permission, aka an \"interface access control vulnerability,\" a different vulnerability than CVE-2015-8307.", "published": "2016-04-07T16:59:03", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8680", "cvelist": ["CVE-2015-8680"], "lastseen": "2016-09-03T23:27:23"}, {"id": "CVE-2015-8307", "type": "cve", "title": "CVE-2015-8307", "description": "The Graphics driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, GRA-UL00 before GRA-UL00C00B230, and GRA-UL10 before GRA-UL10C00B230, and Mate S smartphones with software CRR-TL00 before CRR-TL00C01B160SP01, CRR-UL00 before CRR-UL00C00B160, and CRR-CL00 before CRR-CL00C92B161 allows attackers to cause a denial of service (system crash) or gain privileges via a crafted application with the graphics permission, aka an \"interface access control vulnerability,\" a different vulnerability than CVE-2015-8680.", "published": "2016-04-07T16:59:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8307", "cvelist": ["CVE-2015-8307"], "lastseen": "2016-09-03T23:23:24"}, {"id": "CVE-2015-8319", "type": "cve", "title": "CVE-2015-8319", "description": "Heap-based buffer overflow in the HIFI driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, GRA-UL00 before GRA-UL00C00B230, and GRA-UL10 before GRA-UL10C00B230, and Mate S smartphones with software CRR-TL00 before CRR-TL00C01B160SP01, CRR-UL00 before CRR-UL00C00B160, and CRR-CL00 before CRR-CL00C92B161 allows attackers to cause a denial of service (system crash) or gain privileges via a crafted application, a different vulnerability than CVE-2015-8318.", "published": "2016-04-07T16:59:01", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8319", "cvelist": ["CVE-2015-8319"], "lastseen": "2016-09-03T23:23:29"}, {"id": "CVE-2015-8318", "type": "cve", "title": "CVE-2015-8318", "description": "Heap-based buffer overflow in the HIFI driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, GRA-UL00 before GRA-UL00C00B230, and GRA-UL10 before GRA-UL10C00B230, and Mate S smartphones with software CRR-TL00 before CRR-TL00C01B160SP01, CRR-UL00 before CRR-UL00C00B160, and CRR-CL00 before CRR-CL00C92B161 allows attackers to cause a denial of service (system crash) or gain privileges via a crafted application, a different vulnerability than CVE-2015-8319.", "published": "2016-04-07T16:59:01", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8318", "cvelist": ["CVE-2015-8318"], "lastseen": "2016-09-03T23:23:27"}, {"id": "CVE-2015-8681", "type": "cve", "title": "CVE-2015-8681", "description": "The ovisp driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, GRA-UL00 before GRA-UL00C00B230, and GRA-UL10 before GRA-UL10C00B230, and Mate S smartphones with software CRR-TL00 before CRR-TL00C01B160SP01, CRR-UL00 before CRR-UL00C00B160, and CRR-CL00 before CRR-CL00C92B161 allows attackers to cause a denial of service (system crash) or gain privileges via a crafted application with the camera permission, aka an \"interface access control vulnerability.\"", "published": "2016-04-07T16:59:04", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8681", "cvelist": ["CVE-2015-8681"], "lastseen": "2016-09-03T23:27:23"}]}}