NULL Pointer Dereference Vulnerability in Samsung Android Devices
CVE-2016-2036

5.5MEDIUM

Key Information:

Vendor

Samsung
Status
Galaxy S6 Firmware
Vendor
CVE Published:
13 April 2017

What is CVE-2016-2036?

A vulnerability in the Samsung kernel for Android devices allows attackers to exploit a flaw in the getURL function within secfilter. Specifically, the vulnerability arises when a crafted 'GET HTTP/1.1' request triggers a NULL pointer dereference, leading to potential system instability or unauthorized access. This issue affects specific builds on the Samsung Galaxy Note 3 and Galaxy S6, emphasizing the necessity of prompt updates and security measures for users of these devices.

References

https://github.com/ud2/advisories/tree/master/android/sam...
x_refsource_MISC

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.