Hackhackdump

**Name of the Vulnerable Software and Affected Versions** Dressroom versions prior to SMR Sep-2024 Release 1 **Description** The issue is related to improper access control in a key input related function, allowing local attackers to access protected data. User interaction is required to trigger this issue. **Recommendations** For versions prior to SMR Sep-2024 Release 1, update to SMR Sep-2024 Release 1 or later to resolve the issue. As a temporary workaround, consider restricting access to the key input related function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** ThemeCenter versions prior to SMR Sep-2024 Release 1 **Description** The issue is related to improper input validation in ThemeCenter, which allows physical attackers to install privileged applications. **Recommendations** For versions prior to SMR Sep-2024 Release 1, update to SMR Sep-2024 Release 1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Dressroom versions prior to SMR Sep-2024 Release 1 **Description** The issue is related to improper access control in item selection, allowing local attackers to access protected data. User interaction is required to trigger this issue. There is no information provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited. **Recommendations** For versions prior to SMR Sep-2024 Release 1, update to SMR Sep-2024 Release 1 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive data in the Dressroom until the update is applied.

**Name of the Vulnerable Software and Affected Versions** GalaxyStore versions prior to 4.5.81.0 **Description** The issue is related to improper verification of intent by a broadcast receiver in GalaxyStore, allowing local attackers to launch unexported activities of GalaxyStore. **Recommendations** For GalaxyStore versions prior to 4.5.81.0, update to version 4.5.81.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Samsung Health versions prior to 6.27.0.113 **Description** The issue is related to improper input validation, allowing local attackers to write arbitrary document files to the sandbox of Samsung Health. This requires user interaction to trigger. **Recommendations** For versions prior to 6.27.0.113, update to version 6.27.0.113 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Samsung Data Store versions prior to 5.3.00.4 **Description** The issue is related to improper access control in Samsung Data Store, allowing local attackers to launch arbitrary activities with the privilege of Samsung Data Store. **Recommendations** For versions prior to 5.3.00.4, update to version 5.3.00.4 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Search Widget versions prior to 3.4 **Description** The issue allows local attackers to access data through a PendingIntent hijacking vulnerability in the Search Widget, specifically in China models. **Recommendations** For versions prior to 3.4, update to version 3.4 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Samsung Push Service versions prior to 3.4.10 **Description** The issue is related to improper access control, allowing local attackers to obtain a register ID that can be used to identify the device. **Recommendations** For versions prior to 3.4.10, update to version 3.4.10 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** PackageInstallerCHN versions prior to 13.1.03.00 **Description** The issue allows a local attacker to access arbitrary files due to an intent redirection vulnerability. This vulnerability requires user interaction. **Recommendations** For versions prior to 13.1.03.00, update to version 13.1.03.00 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Calendar application versions prior to 12.4.07.15 **Description** The issue allows attackers to write arbitrary files due to a potential zip path traversal vulnerability in the Calendar application. This vulnerability is present in Android 13. **Recommendations** For versions prior to 12.4.07.15, update to version 12.4.07.15 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Samsung Pass versions prior to 4.2.03.1 **Description** The issue is related to improper authentication in Samsung Pass, allowing a local attacker to access stored account information when Samsung Wallet is not installed. **Recommendations** For versions prior to 4.2.03.1, update to version 4.2.03.1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Samsung Core Service versions prior to 2.1.00.36 **Description** The issue is related to improper access control in the Samsung Core Service, allowing an attacker to write arbitrary files in the sandbox. **Recommendations** For versions prior to 2.1.00.36, update to version 2.1.00.36 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Bluetooth versions prior to SMR Mar-2023 Release 1 **Description** The issue is related to improper access control in Bluetooth, allowing attackers to send files without the necessary permissions. **Recommendations** For versions prior to SMR Mar-2023 Release 1, update to SMR Mar-2023 Release 1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** BixbyTouch versions prior to 3.2.02.5 **Description** The issue is related to improper access control, allowing untrusted applications to access local files. This affects BixbyTouch in China models. **Recommendations** For versions prior to 3.2.02.5, update to version 3.2.02.5 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Samsung Calendar versions prior to 12.4.02.9000 in Android 13 Samsung Calendar versions prior to 12.3.08.2000 in Android 12 **Description** The issue is related to improper access control, allowing a local attacker to configure an improper status. This could potentially lead to unauthorized access or modifications. **Recommendations** For Samsung Calendar versions prior to 12.4.02.9000 in Android 13, update to version 12.4.02.9000 or later. For Samsung Calendar versions prior to 12.3.08.2000 in Android 12, update to version 12.3.08.2000 or later.