PT-2020-16058 · Samsung · Quram Image Codec Library

Published 2020-09-11 · Updated 2020-09-21 · CVE-2020-25278

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Samsung mobile devices with O(8.x) software Samsung mobile devices with P(9.0) software Samsung mobile devices with Q(10.0) software

Description The issue allows attackers to overwrite memory and execute arbitrary code via crafted JPEG data that is mishandled during decoding by the Quram image codec library.

Recommendations For Samsung mobile devices with O(8.x) software, update the Quram image codec library to prevent memory overwrite and arbitrary code execution. For Samsung mobile devices with P(9.0) software, update the Quram image codec library to prevent memory overwrite and arbitrary code execution. For Samsung mobile devices with Q(10.0) software, update the Quram image codec library to prevent memory overwrite and arbitrary code execution.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2020-25278

Affected Products

Quram Image Codec Library

References · 3

• https://security.samsungmobile.com/securityUpdate.smsb · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25278 · Security Note
• https://osv.dev/vulnerability/CVE-2020-25278 · Vendor Advisory