PT-2021-16539 · Samsung · Libimagecodec+1

Published 2021-03-04 · Updated 2021-03-26 · CVE-2021-25346

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: quram library versions prior to SMR Jan-2021 Release 1 Samsung Galaxy S20 (affected versions not specified)

Description: The issue concerns a possible arbitrary memory overwrite that allows arbitrary code execution. This is related to an Out-Of-Bounds Read Information Disclosure Vulnerability in the libimagecodec of the Samsung Galaxy S20.

Recommendations: For quram library versions prior to SMR Jan-2021 Release 1, update to a version released after SMR Jan-2021 Release 1. For Samsung Galaxy S20, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2021-25346

ZDI-21-342

Affected Products

Samsung Galaxy S20

Libimagecodec

References · 6

• https://zerodayinitiative.com/advisories/ZDI-21-342 · Security Note
• https://security.samsungmobile.com · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-25346 · Vendor Advisory
• https://security.samsungmobile.com/securityUpdate.smsb · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25346 · Security Note
• https://t.me/cibsecurity/24488 · Telegram Post