CVSS: 7.8EPSS: 0%CPEs: 21EXPL: 0CVE-2017-3748
https://notcve.org/view.php?id=CVE-2017-3748
On Lenovo VIBE mobile phones, improper access controls on the nac_server component can be abused in conjunction with CVE-2017-3749 and CVE-2017-3750 to elevate privileges to the root user (commonly known as 'rooting' or "jail breaking" a device). En los teléfonos móviles Lenovo VIBE, los controles de acceso incorrectos en el componente nac_server puede emplearse junto con CVE-2017-3749 y CVE-2017-3750 para elevar los privilegios a usuario root (conocido comúnmente como "rooting" o "jail breaking" de un dispositivo). • http://www.securityfocus.com/bid/99295 https://support.lenovo.com/us/en/product_security/LEN-15823 •
CVSS: 6.9EPSS: 0%CPEs: 21EXPL: 0CVE-2017-3749
https://notcve.org/view.php?id=CVE-2017-3749
On Lenovo VIBE mobile phones, the Idea Friend Android application allows private data to be backed up and restored via Android Debug Bridge, which allows tampering leading to privilege escalation in conjunction with CVE-2017-3748 and CVE-2017-3750. En los teléfonos móviles Lenovo VIBE, la aplicación de Android Idea Friend permite que los datos privados se copien y restauren mediante Android Debug Bridge, lo que permite la falsificación que conduce a un escalado de privilegios junto con CVE-2017-3748 y CVE-2017-3750. • https://support.lenovo.com/us/en/product_security/LEN-15823 •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2015-3840
https://notcve.org/view.php?id=CVE-2015-3840
The MessageStatusReceiver service in the AndroidManifest.XML in Android 5.1.1 and earlier allows local users to alter sent/received statuses of SMS and MMS messages without the associated "WRITE_SMS" permission. El servicio MessageStatusReceiver en AndroidManifest.XML en Android 5.1.1 y versiones anteriores permite a usuarios locales alterar los estados de mensajes SMS y MMS enviados / recibidos sin el permiso "WRITE_SMS" asociado. • http://blog.trendmicro.com/trendlabs-security-intelligence/os-x-zero-days-on-the-rise-a-2015-midyear-review-on-advanced-attack-surfaces http://blog.trendmicro.com/trendlabs-security-intelligence/two-new-android-bugs-mess-up-messaging-may-lead-to-multiple-send-charges https://huntcve.github.io/2017/02/13/cveupdate • CWE-284: Improper Access Control •
CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 0CVE-2017-0639
https://notcve.org/view.php?id=CVE-2017-0639
An information disclosure vulnerability in Bluetooth component could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it is a general bypass for operating system protections that isolate application data from other applications. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-35310991. • http://www.securityfocus.com/bid/98871 http://www.securitytracker.com/id/1038623 https://source.android.com/security/bulletin/2017-06-01 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.1EPSS: 0%CPEs: 8EXPL: 0CVE-2017-0641
https://notcve.org/view.php?id=CVE-2017-0641
A remote denial of service vulnerability in libvpx in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High severity due to the possibility of remote denial of service. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34360591. • http://www.securityfocus.com/bid/98868 http://www.securitytracker.com/id/1038623 https://android.googlesource.com/platform/external/libvpx/+/698796fc930baecf5c3fdebef17e73d5d9a58bcb https://source.android.com/security/bulletin/2017-06-01 • CWE-665: Improper Initialization •