[Galaxy Note 4 General] henklbr:
Samsung Android Security Updates

SMR-OCT-2015

Samsung Mobile is releasing a maintenance release for select models as part of the monthly Samsung Android Security Update process.

This security update package includes patches from Google and Samsung.

Google patches include all patches up to Android Security Bulletin - October 2015.

The Bulletin (October 2015) has 48 items, which also contain the following 29 CVE items:

CVE-2015-3873, CVE-2015-3872, CVE-2015-3871, CVE-2015-3868, CVE-2015-3867, CVE-2015-3869, CVE-2015-3870, CVE-2015-3823, CVE-2015-6598, CVE-2015-6599,

CVE-2015-6600, CVE-2015-6603, CVE-2015-6601, CVE-2015-3876, CVE-2015-6604, CVE-2015-3874, CVE-2015-3875, CVE-2015-6602, CVE-2015-3877, CVE-2015-3863,

CVE-2015-3879, CVE-2015-3865, CVE-2015-6596, CVE-2015-3878, CVE-2015-3847, CVE-2015-6605, CVE-2015-3862, CVE-2015-6606, and CVE-2015-6607.

※ Please see Android Security Bulletin for detailed information on Google patches.

Along with Google patches, Samsung Mobile provides 14 Samsung Vulnerabilities and Exposures (SVE) items described below, in order to improve our customer’s confidence on security of Samsung Mobile devices¹.

SVE-2015-2846: Information theft and screen theft attack for Galaxy S5

Affected versions: JBP(4.3) and above

Reported on: October 12, 2014

Disclosure status: This issue is publicly known.

An attacker can craft a Parcelable object specifying arbitrary class files that will be loaded, resulting in remote code execution as the system user.

This comes from absence of restricting the source of the classes to be loaded in the createFromParcel() function.

SVE-2015-2858: Samsung SBeam Image Remote Information Disclosure Vulnerability

Affected versions: JBP(4.3) and above

Reported on: July 28, 2015

Disclosure status: This issue is publicly known.

A vulnerability in the way that SBeam handles initial connection can allow an attacker to download any or all images in the context of the SBeam service.

This attack is done when a vulnerable device launches HTTP server on port 15000 because this server doesn’t authenticate an opponent.

The patch ensures that the other side is reliable by adding a procedure to confirm the user before sharing contents.

SVE-2015-2885: Resurrecting the READ_LOGS permission

Affected versions: JBP(4.3), and KK(4.4.2)

Reported on: July 28, 2015

Disclosure status: This issue is publicly known.

The sensitive information can be disclosed by generating a world-readable copy of the log file in case of following three reasons:

Unhandled exception in Dalvik VM’, ‘Application not responding ANR event’, and ‘Crash on an application’s native code’.

The fix restricts target users by reducing a read permission.

SVE-2015-4722: Defects Fix for Code Review Result of Stagefright

Affected versions: JBP(4.3) and above

Reported on: August 18, 2015

Disclosure status: This issue is publicly known.

The absence of checking bounds to allocate memory at Stagefright can lead to heap overflow by dereference of large memory after small memory (0 size) allocation.

This fix can prevent heap overflow by checking the size.

¹ Some SVE items included in the Samsung Android Security Update cannot be disclosed at this time.