PT-2020-7899 · Canonical · Unity8

Michael Terry + 1 · Published 2020-05-07 · Updated 2020-05-12 · CVE-2015-7946

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Unity8 versions prior to 8.11+16.04.20160111.1-0ubuntu1 Unity8 versions prior to 8.11+15.04.20160122-0ubuntu1

Description: The issue allows an attacker to enable the MTP service by opening the emergency dialer, potentially exposing information. This affects Unity8 as used on the Ubuntu phone and possibly also in Unity8 shipped elsewhere.

Recommendations: For versions prior to 8.11+16.04.20160111.1-0ubuntu1, update to 8.11+16.04.20160111.1-0ubuntu1 or later. For versions prior to 8.11+15.04.20160122-0ubuntu1, update to 8.11+15.04.20160122-0ubuntu1 or later. As a temporary workaround, consider restricting access to the emergency dialer to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2015-7946

Affected Products

Unity8

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2015-7946 · Security Note
• https://cve.org/CVERecord?id=CVE-2015-7946 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-7946 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-7946 · Vendor Advisory
• https://launchpad.net/bugs/1525981 · Note
• https://t.me/cibsecurity/11935 · Telegram Post
• https://t.me/cvenotify/3658 · Telegram Post