Input validation

An improper input validation vulnerability in libsapeextractor library prior to SMR Sep-2021 Release 1 allows attackers to execute arbitrary code in mediaextractor process...

CVE-2021-25462

CVE-2021-25462 describes a NULL pointer dereference in Samsung NPU driver prior to SMR Sep-2021 Release 1, leading to memory corruption. The vulnerability is local (attack vector: LOCAL) with low attack complexity per CVSS v3.1, and impacts memory integrity/availability as specified. Affected com...

CVE-2021-25460

CVE-2021-25460 affects BlockchainTZService, where an improper access control in the sspExit() function could allow an attacker to terminate the service. The issue is limited to BlockchainTZService prior to SMR Sep-2021 Release 1. Impact is service termination (availability). Remediation: upgrade ...

CVE-2021-25459

CVE-2021-25459 affects BlockchainTZService. The vulnerability is an improper access control in the sspInit() function that allows attackers to start the BlockchainTZService. Affected versions are prior to SMR Sep-2021 Release 1. Exploitation details are not provided beyond local access vectors im...

CVE-2021-25458

CVE-2021-25458 describes a NULL pointer dereference in the ION driver prior to Samsung SMR Sep-2021 Release 1, leading to memory corruption. Affected component: ION driver; root cause relates to a NULL pointer dereference. Impact (per sources): local attacker could trigger memory corruption with ...

CVE-2021-25457

The CVE-2021-25457 report concerns a vulnerability in Samsung’s DSP driver prior to the SMR September 2021 Release 1. The issue is an improper input validation that allows a local attacker to obtain a limited amount of kernel memory information, affecting kernel memory confidentiality. Affected c...

CVE-2021-25456

CVE-2021-25456 affects the libswmfextractor.so component. The vulnerability is described as an out-of-bounds read that enables an attacker to cause a memcpy at an arbitrary address via a forged WMF file, implying memory corruption with possible in-memory impact. According to the sources, this is ...

CVE-2021-25455

OOB read vulnerability in libsaviextractor.so library prior to SMR Sep-2021 Release 1 allows attackers to access arbitrary address through pointer via forged avi file...

CVE-2021-25454

OOB read vulnerability in libsaacextractor.so library prior to SMR Sep-2021 Release 1 allows attackers to execute remote DoS via forged aac file...

CVE-2021-25454

CVE-2021-25454 corresponds to an OOB read in the libsaacextractor.so library, vulnerability class affecting Samsung SMR components prior to the September 2021 Release 1. The flaw enables remote DoS via a crafted AAC file, as described across multiple sources (NVD/Red Hat/CVE records). Technical c...

CVE-2021-25453

CVE-2021-25453 affects Samsung devices due to improper access control in Bluetooth APIs prior to SMR Sep-2021 Release 1. The vulnerability allows untrusted applications to obtain Bluetooth information. Connected sources indicate the issue originates from Bluetooth API access controls, with mitiga...

CVE-2021-25451

A PendingIntent hijacking in NetworkPolicyManagerService prior to SMR Sep-2021 Release 1 allows attackers to get IMSI data...

CVE-2021-25451

CVE-2021-25451 affects Android’s NetworkPolicyManagerService where a PendingIntent hijack can lead to exposure of IMSI data. The vulnerability is local, requiring user interaction, with a low-moderate CVSS (3.3 on 3.1, base score 3.3; confidentiality impact: Low). Root cause stated: manipulation ...

CVE-2021-25449

The CVE-2021-25449 entry describes an improper input validation in the libsapeextractor library prior to SMR Sep-2021 Release 1, which can lead to arbitrary code execution in the mediaextractor process. The vulnerability is documented across multiple feeds (including Samsung, Red Hat, NVD) and is...

CVE-2021-25443

A use after free vulnerability in conngadget driver prior to SMR AUG-2021 Release 1 allows malicious action by an attacker...

Design/Logic Flaw

A use after free vulnerability in conngadget driver prior to SMR AUG-2021 Release 1 allows malicious action by an attacker...

Design/Logic Flaw

An IV reuse vulnerability in keymaster prior to SMR AUG-2021 Release 1 allows decryption of custom keyblob with privileged process...

CVE-2021-25444

An IV reuse vulnerability in keymaster prior to SMR AUG-2021 Release 1 allows decryption of custom keyblob with privileged process...

CVE-2021-25443

A use after free vulnerability in conngadget driver prior to SMR AUG-2021 Release 1 allows malicious action by an attacker...

JVN#53278122: Minecraft Java Edition vulnerable to directory traversal

Minecraft Java Edition provided by Mojang Studios contains a directory traversal vulnerability CWE-22. Impact Arbitrary JSON files on the system using the product may be deleted by an attacker. Solution Update Minecraft Update Minecraft to the latest version according to the information provided ...