CVE-2018-21045

CVE-2018-21045 affects Samsung mobile devices running N(7.x) and O(8.x). The issue is that clipboard data can be accessed while the device is in the lockscreen state via a copy-and-paste action. This is a local exposure of the clipboard contents (no user interaction required), with the impact des...

CVE-2018-21080

CVE-2018-21080 affects Samsung mobile devices running N(7.x). A physically proximate attacker can use a magnet to activate NFC and bypass the lockscreen (Samsung ID SVE-2017-10897). Exploitation details, affected models/versions, and fixes are not explicitly provided in the connected documents; o...

CVE-2018-21038

An issue was discovered on Samsung mobile devices with N7.x software. The Secure Folder app's startup logic allows authentication bypass. The Samsung ID is SVE-2018-11628 December 2018...

CVE-2018-21038

CVE-2018-21038 concerns Samsung mobile devices running N(7.x) software, where the Secure Folder app’s startup logic permits an authentication bypass. The vulnerability is tied to the Secure Folder startup sequence, enabling bypass of authentication for affected devices (Samsung ID SVE-2018-11628)...

CVE-2018-21082

An issue was discovered on Samsung mobile devices with N7.x software. Dex Station allows App Pinning bypass and lock-screen bypass via the "Use screen lock type to unpin" option. The Samsung ID is SVE-2017-11106 February 2018...

Race condition

An issue was discovered on Samsung mobile devices with L5.1, M6.0, and N7.x software. There is a race condition with a resultant read-after-free issue in getkek. The Samsung ID is SVE-2017-11174 February 2018...

CVE-2018-21081

An issue was discovered on Samsung mobile devices with N7.x software. In Dual Messenger, the second app can use the runtime permissions of the first app without a user's consent. The Samsung ID is SVE-2017-11018 March 2018...

CVE-2018-21081

Technical details are not publicly available in the provided documents; no concrete affected products, components, or fixes are disclosed. Monitor for updates.

CVE-2018-21082

Affected product: Samsung mobile devices running N(7.x) with Dex Station. Issue: Dex Station enables App Pinning bypass and lock-screen bypass via the To unpin screen lock option. Root cause: bypass of app pinning/lock screen through the “Use screen lock type to unpin” flow. Impact: allows bypass...

CVE-2018-21085

CVE-2018-21085 affects Samsung mobile devices running L(5.x), M(6.0), and N(7.x) with a race condition leading to use-after-free in the vnswap_deinit_backing_storage path. The issue is documented under Samsung’s SVE-2017-11176 identity; no remediation details are provided in the connected sources...

CVE-2018-21088

CVE-2018-21088 affects Samsung mobile devices running N(7.x). The issue is that InputMethodManagerService exposes an unprotected system service, enabling an attacker to trigger a reboot. The description in connected sources confirms the root cause and impact, but there are no specific patch versi...

CVE-2018-21089

An issue was discovered on Samsung mobile devices with N7.x MT6755/MT6757 Mediatek models software. Bootloader has an integer overflow that leads to arbitrary code execution via the download offset control. The Samsung ID is SVE-2017-10732 January 2018...

CVE-2018-21089

CVE-2018-21089 affects Samsung mobile devices running N(7.x) on MT6755/MT6757 Mediatek chipsets. The root cause is an integer overflow in the bootloader related to the download offset control, enabling arbitrary code execution. The entry notes a Samsung ID SVE-2017-10732 (Jan 2018). Impact is des...

CVE-2017-18669

An issue was discovered on Samsung mobile devices with N7.x software. Persona has an unprotected API that allows launch of any activity with system privileges. The Samsung ID is SVE-2017-9000 June 2017...

CVE-2017-18673

An issue was discovered on Samsung mobile devices with N7.x software. An attacker can disable the Location service on a locked device, making it impossible for the rightful owner to find a stolen device. The Samsung ID is SVE-2017-8524 May 2017...

CVE-2017-18656

An issue was discovered on Samsung mobile devices with M6.0 and N7.x software. There is a buffer over-read in a trustlet. The Samsung ID is SVE-2017-8890 August 2017...

CVE-2017-18650

An issue was discovered on Samsung mobile devices with N7.x software. There is a WifiStateMachine IllegalArgumentException and reboot if a malformed wpasupplicant.conf is read. The Samsung ID is SVE-2017-9828 October 2017...

CVE-2017-18649

An issue was discovered on Samsung mobile devices with N7.x software. An attacker can boot a device with root privileges because the bootloader for the Qualcomm MSM8998 chipset lacks an integrity check of the system image, aka the "SamFAIL" issue. The Samsung ID is SVE-2017-10465 November 2017...

CVE-2017-18660

An issue was discovered on Samsung mobile devices with M6.0 and N7.x software. There is a buffer overflow in tlcserver. The Samsung ID is SVE-2017-8888 July 2017...

Design/Logic Flaw

An issue was discovered on Samsung mobile devices with N7.x software. An attacker can disable the Location service on a locked device, making it impossible for the rightful owner to find a stolen device. The Samsung ID is SVE-2017-8524 May 2017...