medium5.5Public exploit code
CVE-2015-7889
The SecEmailComposer/EmailComposer application in the Samsung S6 Edge before the October 2015 MR uses weak permissions for the com.samsung.android.email.intent…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Samsung - SecEmailComposer QUICK_REPLY_BACKGROUND Permissions2015-10-28 · dos · android · Verified
Impact
The SecEmailComposer/EmailComposer application in the Samsung S6 Edge before the October 2015 MR uses weak permissions for the com.samsung.android.email.intent.action.QUICK_REPLY_BACKGROUND service action, which might allow remote attackers with knowledge of the local email address to obtain sensitive information via a crafted application that sends a crafted intent.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Android | through 5.1.1 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/134105/Samsung-SecEmailComposer-QUICK_REPLY_BACKGROUND-Permission-Weakness.html
- http://www.securityfocus.com/bid/77339
- https://bugs.chromium.org/p/project-zero/issues/detail?id=490&redir=1
- https://www.exploit-db.com/exploits/38558/
- http://packetstormsecurity.com/files/134105/Samsung-SecEmailComposer-QUICK_REPLY_BACKGROUND-Permission-Weakness.html
- http://www.securityfocus.com/bid/77339
- https://bugs.chromium.org/p/project-zero/issues/detail?id=490&redir=1
- https://www.exploit-db.com/exploits/38558/