PT-2017-7291 · Samsung · Samsung S6 Edge

Published 2017-12-27 · Updated 2018-01-17 · CVE-2015-7889

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Samsung S6 Edge versions prior to October 2015 MR

Description The issue concerns weak permissions in the SecEmailComposer/EmailComposer application. This weakness might allow remote attackers with knowledge of the local email address to obtain sensitive information via a crafted application that sends a crafted intent to the com.samsung.android.email.intent.action.QUICK REPLY BACKGROUND service action.

Recommendations For Samsung S6 Edge versions prior to October 2015 MR, update to a version released after the October 2015 MR to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-275

Related Identifiers

CVE-2015-7889

Affected Products

Samsung S6 Edge

References · 5

• 🔥 https://exploit-db.com/exploits/38558 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-7889 · Security Note
• http://packetstormsecurity.com/files/134105/Samsung-SecEmailComposer-QUICK_REPLY_BACKGROUND-Permission-Weakness.html · Note
• https://bugs.chromium.org/p/project-zero/issues/detail?id=490&redir=1 · Note
• http://securityfocus.com/bid/77339 · Note