Security Advisory - Two Security Vulnerabilities in Huawei EMUI

Huawei EMUI3.1 has two vulnerabilities.

The Keyguard application in Huawei EMUI3.1 has a privilege elevation vulnerability due to insufficient validation on specific parameters. An attacker may trick a user into installing a malicious application. Successful exploit could allow the attacker to launch command injection to gain elevated privileges. (Vulnerability ID: HWPSIRT-2017-01086)

This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2017-2692.

Huawei EMUI3.1 has a path traversal vulnerability due to insufficient path check during the decompression of files of specific types. An attacker may trick a user into downloading and installing malicious software. Successful exploit could allow the attacker to decompress malicious files into a target path. (Vulnerability ID: HWPSIRT-2017-01097)

This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2017-2693.

Huawei has released software updates to fix these two vulnerabilities. This advisory is available at the following link: <http://www.huawei.com/cn/psirt/security-advisories/huawei-sa-20170125-01-emui-cn&gt;