Date: Wed, 9 Nov 2016 15:41:47 +0800 From: Idler <idler1984@...il.com> To: oss-security@...ts.openwall.com, Anarcheuz Fritz <anarcheuz@...il.com>, cve-assign@...re.org Subject: CVE Request - Samsung Exynos fimg2d Multiple Issues Hello, I'd like to request for CVEs for the following two vulnearbilities fixed in Samsung Exynos fimg2d driver for Android: Security bulletin: http://security.samsungmobile.com/smrupdate.html#SMR-NOV-2016 SVE-2016-6736: Kernel Crash on /dev/fimg2d ioctl command Severity: Medium Affected versions: All devices with Exynos 5433/54xx/7420 chipsets Reported on: June 11, 2016 Disclosure status: Privately disclosed. The fimg2d which is one of the graphic devices for Exynos chipsets doesn’t have exception control routines to handle unexpected commands and it can lead to kernel panic. The patch prevents kernel panic by ignoring inappropriate commands at the state. SVE-2016-6853: Use After Free in /dev/fimg2d Severity: Medium Affected versions: All devices with Exynos 5433/54xx/7420 chipsets Reported on: August 5, 2016 Disclosure status: Privately disclosed. A use-after-free vulnerability in fimg2d allows attackers to gain access to unauthorized data. The patch with error handling was applied. Thank you, James
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ