CVE-2018-16271
Medium
Description
The wemail_consumer_service (from the built-in application wemail) in Samsung Galaxy Gear series allows an unprivileged process to manipulate a user's mailbox, due to improper D-Bus security policy configurations. An arbitrary email can also be sent from the mailbox via the paired smartphone. This affects Tizen-based firmwares including Samsung Galaxy Gear series before build RE2.
SeverityMedium
CVSS6.5
Exploit probability—
Product
Samsung Galaxy Gear Firmware
PublishedJan 22, 2020
First seenJan 22, 2020
How to fix
Update
- samsung galaxy_gear_firmwarere2 or later
- samsung gear_2_firmwarere2 or later
- samsung gear_live_firmwarere2 or later
- samsung gear_s_firmwarere2 or later
- samsung gear_s2_firmwarere2 or later
- samsung gear_s3_firmwarere2 or later
- samsung gear_sport_firmwarere2 or later
- samsung gear_fit_firmwarere2 or later
- samsung gear_fit_2_firmwarere2 or later
- samsung gear_fit_2_pro_firmwarere2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| samsung galaxy_gear_firmware | v < re2 | re2 |
| samsung gear_2_firmware | v < re2 | re2 |
| samsung gear_live_firmware | v < re2 | re2 |
| samsung gear_s_firmware | v < re2 | re2 |
| samsung gear_s2_firmware | v < re2 | re2 |
| samsung gear_s3_firmware | v < re2 | re2 |
| samsung gear_sport_firmware | v < re2 | re2 |
| samsung gear_fit_firmware | v < re2 | re2 |
| samsung gear_fit_2_firmware | v < re2 | re2 |
| samsung gear_fit_2_pro_firmware | v < re2 | re2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.