CWE Code: 22
Vulnerability Type: privilege_escalation
CVSS Score: 6.4
CWE Name:  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Summary: directory traversal vulnerability in the swiftkey language-pack update implementation on samsung galaxy s4, s4 mini, s5, and s6 devices allows remote web servers to write to arbitrary files, and consequently execute arbitrary code in a privileged context, by leveraging control of the skslm.swiftkey.net domain name and providing a .. (dot dot) in an entry in a zip archive, as demonstrated by a traversal to the /data/dalvik-cache directory.
Access Authentication: NONE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): NONE/PARTIAL/PARTIAL
Published Date: 2015-06-19
Last Modified Date: 2016-12-07