CVE-2020-12748

CVE-2020-12748 affects Samsung mobile devices running Q(10.0); attackers can bypass the locked-state protection to designate a different preferred SIM card. Root cause details are not provided in the documents. Remediation is indicated via Samsung security update SVE-2020-16594; apply the vendor-...

CVE-2020-12748

An issue was discovered on Samsung mobile devices with Q10.0 software. Attackers can bypass the locked-state protection mechanism and designate a different preferred SIM card. The Samsung ID is SVE-2020-16594 May 2020...

CVE-2020-12747

An issue was discovered on Samsung mobile devices with Q10.0 Exynos980 9630 and Exynos990 9830 chipsets software. The Bootloader has a heap-based buffer overflow because of the mishandling of specific commands. The Samsung IDs are SVE-2020-16981, SVE-2020-16991 May 2020...

CVE-2020-12747

CVE-2020-12747 relates to Samsung mobile devices with Q(10.0) using Exynos980/9630 and Exynos990/9830. The issue is a heap-based buffer overflow in the Bootloader caused by mishandling of specific commands. The vulnerability affects the boot process and could lead to unauthorized code execution a...

CVE-2020-12746

CVE-2020-12746 affects Samsung mobile devices (Exynos) on O(8.X), P(9.0), and Q(10.0). The issue is a heap-based buffer overflow that lets an attacker bypass the Secure Bootloader protection mechanism and execute arbitrary code. The Samsung internal ID is SVE-2020-16712 (May 2020). Connected sour...

CVE-2020-6616

Some Broadcom chips mishandle Bluetooth random-number generation because a low-entropy Pseudo Random Number Generator PRNG is used in situations where a Hardware Random Number Generator HRNG should have been used to prevent spoofing. This affects, for example, Samsung Galaxy S8, S8+, and Note8...

CVE-2020-6616

Some Broadcom chips mishandle Bluetooth random-number generation because a low-entropy Pseudo Random Number Generator PRNG is used in situations where a Hardware Random Number Generator HRNG should have been used to prevent spoofing. This affects, for example, Samsung Galaxy S8, S8+, and Note8...

Code injection

Some Broadcom chips mishandle Bluetooth random-number generation because a low-entropy Pseudo Random Number Generator PRNG is used in situations where a Hardware Random Number Generator HRNG should have been used to prevent spoofing. This affects, for example, Samsung Galaxy S8, S8+, and Note8...

CVE-2020-6616

CVE-2020-6616 involves Broadcom BCM4361 Bluetooth RNG: a low-entropy PRNG is used where a Hardware RNG should be, enabling spoofing risks. Publicly documented impact references include Apple’s iOS 13.5/iPadOS 13.5 notes, which list CVE-2020-6616 under Bluetooth with a low-entropy PRNG issue, affe...

CVE-2020-6616

Some Broadcom chips mishandle Bluetooth random-number generation because a low-entropy Pseudo Random Number Generator PRNG is used in situations where a Hardware Random Number Generator HRNG should have been used to prevent spoofing. This affects, for example, Samsung Galaxy S8, S8+, and Note8...

Heap overflow

There is a buffer overwrite vulnerability in the Quram qmg library of Samsung's Android OS versions O8.x, P9.0 and Q10.0. An unauthenticated, unauthorized attacker sending a specially crafted MMS to a vulnerable phone can trigger a heap-based buffer overflow in the Quram image codec leading to an...

CVE-2020-8899

CVE-2020-8899 covers a buffer/heap overflow in Samsung’s Quram qmg (Qmage) codec used by Android Skia, affecting O(8.x), P(9.0), and Q(10.0). An unauthenticated MMS can trigger an RCE via a heap-based overflow in the Quram/QMG image decoding path (QMG/QM formats), with Project Zero documenting th...

CVE-2020-8899 Memory corruption in Quram library when decoding qmg can lead to RCE

There is a buffer overwrite vulnerability in the Quram qmg library of Samsung's Android OS versions O8.x, P9.0 and Q10.0. An unauthenticated, unauthorized attacker sending a specially crafted MMS to a vulnerable phone can trigger a heap-based buffer overflow in the Quram image codec leading to an...

CVE-2020-8899 Samsung Quarm RCE via MMS

There is a buffer overwrite vulnerability in the Quram qmg library of Samsung's Android OS versions O8.x, P9.0 and Q10.0. An unauthenticated, unauthorized attacker sending a specially crafted MMS to a vulnerable phone can trigger a heap-based buffer overflow in the Quram image codec leading to an...

binutils security and bug fix update

2.30-73.0.1 - Forward-port of Oracle patches from 2.30-68.0.2. - Reviewed-by: Elena Zannoni 2.30-68.0.2 - Backport the non-cycle-detecting-capable deduplicating CTF linker - Backport a fix for an upstream hashtab crash no upstream bug number, triggered by the above. - Fix deduplication of...

CVE-2015-9546

An issue was discovered on Samsung mobile devices with KK4.4 and later software through 2015-06-16. In some cases, HTTP is used for an Inputmethod, rather than HTTPS. A man-in-the-middle attacker can modify the client-server data stream to insert directory traversal sequences into an extracted fi...

CVE-2015-9547

An issue was discovered on Samsung mobile devices with JBP4.3 and KK4.4.2 software. Because the READLOGS permission is mishandled, sensitive information is disclosed in a world-readable copy of the log file if the error message is "Unhandled exception in Dalvik VM," "Application not responding AN...

CVE-2015-5524

An issue was discovered on Samsung mobile devices with KK4.4 and later software through 2015-05-13. There is a buffer overflow in datablockwrite because the amount of received data is not validated. The Samsung ID is SVE-2015-4018 December 2015...

Directory traversal

An issue was discovered on Samsung mobile devices with KK4.4 and later software through 2015-06-16. In some cases, HTTP is used for an Inputmethod, rather than HTTPS. A man-in-the-middle attacker can modify the client-server data stream to insert directory traversal sequences into an extracted fi...

Design/Logic Flaw

An issue was discovered on Samsung mobile devices with JBP4.3 and KK4.4.2 software. Because the READLOGS permission is mishandled, sensitive information is disclosed in a world-readable copy of the log file if the error message is "Unhandled exception in Dalvik VM," "Application not responding AN...