Dzmitry Lukyanenka

**Name of the Vulnerable Software and Affected Versions** Samsung Dialer versions prior to SMR Feb-2026 Release 1 **Description** A flaw exists due to the improper export of Android application components in Samsung Dialer. This allows a local attacker to launch arbitrary activity with Samsung Dialer privileges. **Recommendations** Update Samsung Dialer to SMR Feb-2026 Release 1 or later.

**Name of the Vulnerable Software and Affected Versions** tech.palm.id (affected versions not specified) **Description** An authentication issue exists in the mobile application that may result in information disclosure. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Software (affected versions not specified) versions prior to SMR Nov-2024 Release 1 **Description** The issue is related to an out-of-bounds write in libsapeextractor.so, allowing local attackers to cause memory corruption. This flaw exists in versions prior to the SMR Nov-2024 Release 1. Local attackers can trigger this issue, potentially leading to memory corruption. **Recommendations** For versions prior to SMR Nov-2024 Release 1, update to the SMR Nov-2024 Release 1 or later to resolve the issue. As a temporary workaround, consider restricting access to the libsapeextractor.so library until a patch is available.

**Name of the Vulnerable Software and Affected Versions** System UI versions prior to SMR Nov-2024 Release 1 **Description** The issue allows local attackers to expose sensitive information and make malicious apps appear as legitimate. This is achieved by exploiting a flaw in the System UI. **Recommendations** For versions prior to SMR Nov-2024 Release 1, update to the SMR Nov-2024 Release 1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Samsung Dialer versions prior to SMR May-2024 Release 1 **Description** The issue allows local attackers to make a call without proper permission due to an improper component protection vulnerability. **Recommendations** For Samsung Dialer versions prior to SMR May-2024 Release 1, update to SMR May-2024 Release 1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** FactoryCamera versions prior to SMR May-2024 Release 1 **Description** The issue is related to improper access control, allowing local attackers to take pictures without the necessary privileges. This could potentially lead to unauthorized access to sensitive information. **Recommendations** For versions prior to SMR May-2024 Release 1, update to the SMR May-2024 Release 1 or later to resolve the issue. As a temporary workaround, consider restricting access to the camera functionality to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** KnoxCustomManagerService versions prior to SMR Dec-2023 Release 1 **Description** The issue is related to improper access control, allowing an attacker to access the device SIM PIN. This could potentially lead to unauthorized access to sensitive information. **Recommendations** For versions prior to SMR Dec-2023 Release 1, update to the SMR Dec-2023 Release 1 or later to resolve the issue. As a temporary workaround, consider restricting access to the KnoxCustomManagerService until a patch is available.

**Name of the Vulnerable Software and Affected Versions** System UI versions prior to SMR Mar-2023 Release 1 **Description** The issue is related to improper privilege management in PhoneStatusBarPolicy, allowing an attacker to turn off 'Do not disturb' via an unprotected intent. **Recommendations** For versions prior to SMR Mar-2023 Release 1, update to SMR Mar-2023 Release 1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** SecSettings versions prior to SMR Mar-2023 Release 1 **Description** The issue is related to improper authentication in SecSettings, allowing an attacker to reset the setting. **Recommendations** For versions prior to SMR Mar-2023 Release 1, update to SMR Mar-2023 Release 1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** NFC driver versions prior to SMR Oct-2022 Release 1 **Description** The issue is related to a use after free vulnerability in the `set nft pid` and `signal handler` function of the NFC driver. This vulnerability allows attackers to perform malicious actions. **Recommendations** For NFC driver versions prior to SMR Oct-2022 Release 1, consider disabling the `set nft pid` and `signal handler` functions until a patch is available. As a temporary workaround, restrict access to the NFC driver to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Video Editor versions prior to SMR Sep-2022 Release 1 **Description** The issue allows a local attacker to access internal application data due to an improper authorization vulnerability. **Recommendations** For versions prior to SMR Sep-2022 Release 1, update to the SMR Sep-2022 Release 1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Wi-Fi Service versions prior to SMR AUG-2022 Release 1 **Description** The issue is related to improper access control in the Wi-Fi Service, allowing untrusted applications to manipulate the list of apps that can use mobile data. **Recommendations** For versions prior to SMR AUG-2022 Release 1, update to SMR AUG-2022 Release 1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** SecDevicePickerDialog versions prior to SMR Aug-2022 Release 1 **Description** A vulnerable code in the `onCreate` method of SecDevicePickerDialog allows attackers to trick the user into selecting an unwanted Bluetooth device via tapjacking or overlay attack. **Recommendations** For versions prior to SMR Aug-2022 Release 1, update to SMR Aug-2022 Release 1 or later to resolve the issue. As a temporary workaround, consider restricting the use of Bluetooth device selection features in SecDevicePickerDialog until a patch is available.

**Name of the Vulnerable Software and Affected Versions** TelephonyUI versions prior to SMR Jul-2022 Release 1 **Description** The issue is related to improper access control in TelephonyUI, allowing attackers to modify the preferred network type through an unprotected binder call. **Recommendations** For versions prior to SMR Jul-2022 Release 1, update to SMR Jul-2022 Release 1 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Samsung Health versions prior to 6.17 Description: The issue is related to an improper check vulnerability that allows an attacker to read internal cache data via an exported component. Recommendations: For versions prior to 6.17, update to version 6.17 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Android versions 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 **Description** The issue is related to an elevation of privilege vulnerability in the Android system ui, which is associated with insufficient access control. This could allow a remote attacker to gain elevated privileges. **Recommendations** For Android versions 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Android versions 6.0 through 7.1.1 **Description** An information disclosure issue in AOSP Messaging could allow a local malicious application to bypass operating system protections, potentially gaining access to isolated application data. This issue is considered High severity because it could be used to access data that the application should not have access to. **Recommendations** For Android versions 6.0 through 7.1.1, update to a version that includes the fix for this issue to prevent potential data access by malicious applications.

**Name of the Vulnerable Software and Affected Versions** AOSP Mail versions 5.0.0 through 5.0.1 AOSP Mail versions 5.1.0 AOSP Mail versions 6.0.0 through 2016-04-30 **Description** The compose functionality in AOSP Mail does not properly restrict attachments, allowing attackers to obtain sensitive information via a crafted application. This issue is related to ComposeActivity.java and ComposeActivityEmail.java. **Recommendations** For AOSP Mail versions 5.0.0 through 5.0.1, update to version 5.0.2 or later. For AOSP Mail version 5.1.0, update to version 5.1.1 or later. For AOSP Mail versions 6.0.0 through 2016-04-30, ensure that updates after 2016-05-01 are applied. As a temporary workaround, consider restricting access to the compose functionality until a patch is available.