CVE-2015-7897

The media scanning functionality in the face recognition library in android.media.process in Samsung Galaxy S6 Edge before G925VVRU4B0G9 allows remote attackers to gain privileges or cause a denial of service memory corruption via a crafted BMP image file...

CVE-2015-7897

CVE-2015-7897 refers to a memory corruption vulnerability in the Samsung Galaxy S6 Edge, caused by the media scanning function in the face-recognition Android library (android.media.process) when processing BMP images. A crafted BMP image can be used to gain privileges or cause a denial of servic...

PT-2015-7656

Name of the Vulnerable Software and Affected Versions Android media process in Samsung Galaxy S6 Edge before version G925VVRU4B0G9 Description The issue concerns the media scanning functionality in the face recognition library, which can be exploited by remote attackers. This can be achieved...

CVE-2015-7897: Improper Restriction of Operations within the Bounds of a Memory Buffer

The media scanning functionality in the face recognition library in android.media.process in Samsung Galaxy S6 Edge before G925VVRU4B0G9 allows remote attackers to gain privileges or cause a denial of service memory corruption via a crafted BMP image file...

Samsung Galaxy S6 Edge Security Vulnerabilities

Google’s Nexus Android devices are considered the most secure by default since they’re guaranteed to receive all security patches for vulnerabilities found internally and those disclosed by third parties. Google’s Project Zero research team, however, decided to expand its reach and test the water...

Samsung Galaxy S6 - android.media.process Face Recognition Memory Corruption

Samsung Galaxy S6 - android.media.process Face Recognition Memory Corruption Source: https://code.google.com/p/google-security-research/issues/detail?id=499 The attached files cause memory corruption when they are scanned by the face recognition library in android.media.process. From faces-art.bm...

Samsung Galaxy S6 - libQjpeg DoIntegralUpsample Crash

Samsung Galaxy S6 - libQjpeg DoIntegralUpsample Crash Source: https://code.google.com/p/google-security-research/issues/detail?id=498 The attached jpg, upsample.jpg can cause memory corruption when media scanning occurs F/libc 8600: Fatal signal 11 SIGSEGV, code 1, fault addr 0x206e6f69747562 in...

Samsung Galaxy S6 Samsung Gallery - Bitmap Decoding Crash

Source: https://code.google.com/p/google-security-research/issues/detail?id=497 Loading the bitmap bmpmemset.bmp can cause a crash due to a memset writing out of bounds. I/DEBUG 2961: pid: 12383, tid: 12549, name: thread-pool-1 com.sec.android.gallery3d I/DEBUG 2961: signal 11 SIGSEGV, code 2...

Samsung Galaxy S6 - android.media.process Face Recognition Memory Corruption

Source: https://code.google.com/p/google-security-research/issues/detail?id=499 The attached files cause memory corruption when they are scanned by the face recognition library in android.media.process. From faces-art.bmp F/libc 11305: Fatal signal 11 SIGSEGV, code 1, fault addr 0x0 in tid 11555...

Samsung Galaxy S6 - libQjpeg DoIntegralUpsample Crash

Source: https://code.google.com/p/google-security-research/issues/detail?id=498 The attached jpg, upsample.jpg can cause memory corruption when media scanning occurs F/libc 8600: Fatal signal 11 SIGSEGV, code 1, fault addr 0x206e6f69747562 in tid 8685 HEAVY0 I/DEBUG 2956: I/DEBUG 2956: Build...

Hack The Galaxy: Hunting Bugs in the Samsung Galaxy S6 Edge

Posted by Natalie Silvanovich, Planner of Bug Bashes Recently, Project Zero researched a popular Android phone, the Samsung Galaxy S6 Edge. We discovered and reported 11 high-impact security issues as a result. This post discusses our motivations behind the research, our approach in looking for...

Samsung - m2m1shot Kernel Driver Buffer Overflow

Samsung - m2m1shot Kernel Driver Buffer Overflow Source: https://code.google.com/p/google-security-research/issues/detail?id=493 The Samsung m2m1shot driver framework is used to provide hardware acceleration for certain media functions, such as JPEG decoding and scaling images. The driver endpoin...

Samsung - SecEmailComposer QUICK_REPLY_BACKGROUND Permissions

Samsung - SecEmailComposer QUICKREPLYBACKGROUND Permissions Source: https://code.google.com/p/google-security-research/issues/detail?id=490 The SecEmailComposer/EmailComposer application used by the Samsung S6 Edge has an exported service action to do quick replies to emails. It was found that th...

Samsung - seiren Kernel Driver Buffer Overflow

Samsung - seiren Kernel Driver Buffer Overflow Source: https://code.google.com/p/google-security-research/issues/detail?id=491 The Exynos Seiren Audio driver has a device endpoint /dev/seiren that is accessible by either the system user or the audio group such as the mediaserver. It was found tha...

Samsung - SecEmailComposer QUICK_REPLY_BACKGROUND Permissions

Source: https://code.google.com/p/google-security-research/issues/detail?id=490 The SecEmailComposer/EmailComposer application used by the Samsung S6 Edge has an exported service action to do quick replies to emails. It was found that this action required no permissions to call, and could lead to...

Samsung WifiHs20UtilityService

A path traversal vulnerability was found in the WifiHs20UtilityService. This service is running on a Samsung S6 Edge device, and may be present on other Samsung device models. WifiHs20UtilityService reads any files placed in /sdcard/Download/cred.zip, and unzips this file into /data/bundle...

PT-2015-6648

The SwiftKey language-pack update implementation on Samsung Galaxy S4, S4 Mini, S5, and S6 devices relies on an HTTP connection to the skslm.swiftkey.net server, which allows man-in-the-middle attackers to write to language-pack files by modifying an HTTP response. NOTE: CVE-2015-4640 exploitatio...

CVE-2015-4640: Undefined Security Weakness

The SwiftKey language-pack update implementation on Samsung Galaxy S4, S4 Mini, S5, and S6 devices relies on an HTTP connection to the skslm.swiftkey.net server, which allows man-in-the-middle attackers to write to language-pack files by modifying an HTTP response. NOTE: CVE-2015-4640 exploitatio...

CVE-2015-4641: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the SwiftKey language-pack update implementation on Samsung Galaxy S4, S4 Mini, S5, and S6 devices allows remote web servers to write to arbitrary files, and consequently execute arbitrary code in a privileged context, by leveraging control of the...

Samsung Galaxy S6 and Galaxy S6 Edge — 8 Things You Should Know

A whole lot of things gone in the official kickoff of Mobile World Congress 2015, but a unique phone with a curved screen on both sides of the device acquired everybody’s attention. That’s what unveiled by Samsung late Sunday. Samsung has officially unveiled its next-generation flagship Smartphon...