CVE-2023-21453

The CVE-2023-21453 issue affects SoftSim TA prior to SMR Mar-2023 Release 1. Root cause: improper input validation in SoftSim TA, enabling local attackers to access protected data. Affected component: SoftSim TA (pre-Release 1). Impact: unauthorized data access with local attack vector; publicati...

CVE-2023-21461

The CVE-2023-21461 entry concerns Samsung mobile devices with an improper authorization vulnerability in the Settings component AutoPowerOnOffConfirmDialog (before SMR Mar-2023 Release 1). The underlying issue allows a local attacker to turn the device off via an unprotected activity. Documented ...

CVE-2023-21452

Improper usage of implicit intent in Bluetooth prior to SMR Mar-2023 Release 1 allows attacker to get MAC address of connected device...

CVE-2023-21458

CVE-2023-21458 involves an improper privilege management in Samsung System UI’s PhoneStatusBarPolicy. This vulnerability affects System UI versions prior to SMR Mar-2023 Release 1, where an attacker could turn off Do Not Disturb via an unprotected intent. The issue is base on local access with lo...

CVE-2023-21439

Improper input validation vulnerability in UwbDataTxStatusEvent prior to SMR Feb-2023 Release 1 allows attackers to launch certain activities...

CVE-2023-21440

Improper access control vulnerability in WindowManagerService prior to SMR Feb-2023 Release 1 allows attackers to take a screen capture...

CVE-2023-21435

Exposure of Sensitive Information vulnerability in Fingerprint TA prior to SMR Feb-2023 Release 1 allows attackers to access the memory address information via log...

CVE-2023-21430

An out-of-bound read vulnerability in mapToBuffer function in libSDKRecognitionText.spensdk.samsung.so library prior to SMR JAN-2023 Release 1 allows attacker to cause memory access fault...

CVE-2023-21428

Improper input validation vulnerability in TelephonyUI prior to SMR Jan-2023 Release 1 allows attackers to configure Preferred Call. The patch removes unused code...

CVE-2023-21420

Use of Externally-Controlled Format String vulnerabilities in STST TA prior to SMR Jan-2023 Release 1 allows arbitrary code execution...

Input validation

Improper logic in HomeScreen prior to SMR Feb-2023 Release 1 allows physical attacker to access App preview protected by Secure Folder...

Format string

Use of Externally-Controlled Format String vulnerabilities in STST TA prior to SMR Jan-2023 Release 1 allows arbitrary code execution...

Design/Logic Flaw

An out-of-bound read vulnerability in mapToBuffer function in libSDKRecognitionText.spensdk.samsung.so library prior to SMR JAN-2023 Release 1 allows attacker to cause memory access fault...

CVE-2023-21429

Improper usage of implict intent in ePDG prior to SMR JAN-2023 Release 1 allows attacker to access SSID...

CVE-2023-21436

Improper usage of implicit intent in Contacts prior to SMR Feb-2023 Release 1 allows attacker to get account ID...

CVE-2023-21424

The CVE-2023-21424 issue affects SemChameleonHelper prior to SMR Jan-2023 Release 1, due to improper handling of insufficient permissions/privileges. An attacker could modify network-related values, network code, carrier ID and operator brand. Impact is limited to local context with low base metr...

PT-2023-18198 · Samsung · Libsdkrecognitiontext.Spensdk.Samsung.So

Name of the Vulnerable Software and Affected Versions: libSDKRecognitionText.spensdk.samsung.so versions prior to SMR JAN-2023 Release 1 Description: The issue is related to an out-of-bound read in the mapToBuffer function, which can cause a memory access fault. Recommendations: For versions prio...

CVE-2023-21436

CVE-2023-21436 affects Samsung Contacts prior to SMR Feb-2023 Release 1, due to improper usage of implicit intents that allows a local attacker to obtain an account ID. Connected sources indicate the issue impacts Samsung Mobile devices and that updates addressing it were included in SMR Feb-2023...

CVE-2023-21428

CVE-2023-21428 affects TelephonyUI prior to SMR Jan-2023 Release 1. The issue is due to improper input validation, allowing an attacker to configure Preferred Call. The patch reportedly removes unused code. Impact per available data includes local access with low to moderate severity (I/L, A/N). ...

CVE-2023-21426

The CVE-2023-21426 vulnerability affects Samsung mobile devices running SMR prior to Jan-2023 Release 1, where a hardcoded AES key is used to encrypt card emulation PINs in NFC. The root cause is the hardcoded key in the NFC card emulation workflow, enabling local attackers to access cardemulatio...