CVE-2023-21436

CVE-2023-21436 affects Samsung Contacts prior to SMR Feb-2023 Release 1, due to improper usage of implicit intents that allows a local attacker to obtain an account ID. Connected sources indicate the issue impacts Samsung Mobile devices and that updates addressing it were included in SMR Feb-2023...

CVE-2023-21430

An out-of-bound read vulnerability in mapToBuffer function in libSDKRecognitionText.spensdk.samsung.so library prior to SMR JAN-2023 Release 1 allows attacker to cause memory access fault...

CVE-2023-21419

An improper implementation logic in Secure Folder prior to SMR Jan-2023 Release 1 allows the Secure Folder container remain unlocked under certain condition...

CVE-2023-21422

The CVE-2023-21422 entry relates to Samsung’s WifiSevice, where the function semAddPublicDnsAddr allows binding the WifiService to set a custom DNS server without permission. Affected are WifiSevice versions prior to SMR Jan-2023 Release 1. The root cause is improper authorization in semAddPublic...

CVE-2023-21439

CVE-2023-21439 concerns an improper input validation vulnerability in the Samsung UwbDataTxStatusEvent component. The issue affects Samsung Mobile devices prior to the SMR Feb-2023 Release 1, enabling attackers to launch certain activities due to malformed input handling. Public documents in conn...

CVE-2023-21440

The CVE-2023-21440 entry maps to an improper access control vulnerability in the WindowManagerService, affecting Samsung Android devices. Root cause: WindowManagerService prior to SMR Feb-2023 Release 1 allows an attacker to capture the screen. Impact: potential exposure of screen content (confid...

PT-2023-18205 · Unknown · Uwbdatatxstatusevent

Name of the Vulnerable Software and Affected Versions: UwbDataTxStatusEvent versions prior to SMR Feb-2023 Release 1 Description: The issue is related to improper input validation, allowing attackers to launch certain activities. Recommendations: For versions prior to SMR Feb-2023 Release 1, upda...

CVE-2023-21421

CVE-2023-21421 concerns the KnoxCustomManagerService on Samsung devices prior to the SMR Jan-2023 Release 1. The issue arises from improper handling of insufficient permissions or privileges, enabling a local attacker with low privileges to access the device’s SIM PIN. The red flags indicate a lo...

CVE-2023-21437

CVE-2023-21437 affects the Samsung Phone application prior to SMR Feb-2023 Release 1. The root cause is improper access control, enabling local attackers to access sensitive information via implicit broadcast. Impact is described as exposure of sensitive data with local attacker access and no use...

CVE-2022-39905

Implicit intent hijacking vulnerability in Telecom application prior to SMR Dec-2022 Release 1 allows attacker to access sensitive information via implicit intent...

CVE-2022-39903

Improper access control vulnerability in RCS call prior to SMR Dec-2022 Release 1 allows local attackers to access RCS incoming call number...

CVE-2022-39901

Improper authentication in Exynos baseband prior to SMR DEC-2022 Release 1 allows remote attacker to disable the network traffic encryption between UE and gNodeB...

Authentication flaw

Improper authentication in Exynos baseband prior to SMR DEC-2022 Release 1 allows remote attacker to disable the network traffic encryption between UE and gNodeB...

PT-2022-25101 · Samsung · Samsung Decoding Library

Name of the Vulnerable Software and Affected Versions: Samsung decoding library versions prior to SMR Dec-2022 Release 1 Description: The issue is related to a TOCTOU vulnerability in the Samsung decoding library for video thumbnails, which allows a local attacker to perform an Out-Of-Bounds Writ...

CVE-2022-39907

CVE-2022-39907 affects Samsung decoding library used in Samsung Mobile devices. The issue is an integer overflow in the library that handles video thumbnails, enabling a local attacker to trigger an out-of-bounds write. Impact is described as high (confidentiality/integiry/availability concerns)....

CVE-2022-39905

CVE-2022-39905 is an implicit intent hijacking vulnerability in the Samsung Telecom application prior to the SMR-DEC-2022 Release 1. The fault is a misused implicit intent that allows an attacker to access sensitive information via intents, with impact described as confidential data exposure and ...

CVE-2022-39895

Improper access control vulnerability in ContactListUtils in Phone prior to SMR Dec-2022 Release 1 allows to access contact group information via implicit intent...

CVE-2022-39897

The CVE-2022-39897 issue affects Samsung Kernel prior to SMR Dec-2022 Release 1, enabling an attacker with local access to leak kernel address information via system logs, i.e., an information disclosure vulnerability. Documented impact: kernel address data exposure with impact on confidentiality...

CVE-2022-39895

The CVE-2022-39895 entry concerns an improper access control vulnerability in ContactListUtils on Samsung Phone software prior to SMR Dec-2022 Release 1. The issue allows access to contact group information via implicit intents, attributed to the ContactListUtils component. Affected product scope...

CVE-2022-39908

CVE-2022-39908 affects Samsung decoding library used for video thumbnails on Samsung Mobile devices prior to SMR Dec-2022 Release 1. The root cause is a TOCTOU condition enabling a local attacker to perform an Out-Of-Bounds Write. Affected component: Samsung decoding library for video thumbnails;...