CVSS: 7.8EPSS: 0%CPEs: 9EXPL: 0CVE-2021-25373
https://notcve.org/view.php?id=CVE-2021-25373
Using unsafe PendingIntent in Customization Service prior to version 2.2.02.1 in Android O(8.x), 2.4.03.0 in Android P(9.0), 2.7.02.1 in Android Q(10.0) and 2.9.01.1 in Android R(11.0) allows local attackers to perform unauthorized action without permission via hijacking the PendingIntent. Un uso de PendingIntent no seguro en el Customization Service anterior a versión 2.2.02.1 en Android O(8.x), versiones 2.4.03.0 en Android P(9.0), versiones 2.7.02.1 en Android Q(10.0) y versiones 2.9.01.1 en Android R(11.0), permite a atacantes locales llevar a cabo un acción no autorizada sin permiso por medio del secuestro de PendingIntent • https://security.samsungmobile.com https://security.samsungmobile.com/serviceWeb.smsb • CWE-285: Improper Authorization •
CVSS: 7.1EPSS: 0%CPEs: 22EXPL: 0CVE-2021-30162
https://notcve.org/view.php?id=CVE-2021-30162
An issue was discovered on LG mobile devices with Android OS 4.4 through 11 software. Attackers can leverage ISMS services to bypass access control on specific content providers. The LG ID is LVE-SMP-210003 (April 2021). Se detectó un problema en los dispositivos móviles de LG con software Android OS versiones 4.4 hasta 11. Los atacantes pueden aprovechar servicios ISMS para omitir el control de acceso en proveedores de contenido específicos. • https://lgsecurity.lge.com •
CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 0CVE-2021-25370 – Samsung Mobile Devices Memory Corruption Vulnerability
https://notcve.org/view.php?id=CVE-2021-25370
An incorrect implementation handling file descriptor in dpu driver prior to SMR Mar-2021 Release 1 results in memory corruption leading to kernel panic. Un descriptor de archivo con manejo de implementación incorrecta en el controlador dpu versiones anteriores a SMR Mar-2021 Release 1, resulta en una corrupción de memoria que conlleva a un pánico del kernel. Samsung mobile devices using Mali GPU contain an incorrect implementation handling file descriptor in dpu driver. This incorrect implementation results in memory corruption, leading to kernel panic. This vulnerability was chained with CVE-2021-25337 and CVE-2021-25369. • https://security.samsungmobile.com https://security.samsungmobile.com/securityUpdate.smsb • CWE-416: Use After Free •
CVSS: 6.2EPSS: 0%CPEs: 4EXPL: 0CVE-2021-25369 – Samsung Mobile Devices Improper Access Control Vulnerability
https://notcve.org/view.php?id=CVE-2021-25369
An improper access control vulnerability in sec_log file prior to SMR MAR-2021 Release 1 exposes sensitive kernel information to userspace. Una vulnerabilidad de control de acceso inapropiado en el archivo sec_log versiones anteriores a SMR MAR-2021 Release 1, expone información confidencial del kernel al espacio de usuario. Samsung mobile devices using Mali GPU contains an improper access control vulnerability in sec_log file. Exploitation of the vulnerability exposes sensitive kernel information to the userspace. This vulnerability was chained with CVE-2021-25337 and CVE-2021-25370. • https://security.samsungmobile.com https://security.samsungmobile.com/securityUpdate.smsb • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2021-25346 – Samsung Galaxy S20 libimagecodec Out-Of-Bounds Read Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2021-25346
A possible arbitrary memory overwrite vulnerabilities in quram library version prior to SMR Jan-2021 Release 1 allow arbitrary code execution. Una posible vulnerabilidad de sobrescritura de memoria arbitraria en la biblioteca quram versión anterior a SMR Jan-2021 Release 1, permite una ejecución de código arbitraria This vulnerability allows remote attackers to disclose sensitive information on affected installations of Samsung Galaxy S20. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the Quram ImageCodec component. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. • https://security.samsungmobile.com https://security.samsungmobile.com/securityUpdate.smsb https://www.zerodayinitiative.com/advisories/ZDI-21-342 • CWE-787: Out-of-bounds Write •