삼성 모바일 9월 업데이트 내역

Samsung Mobile is releasing a maintenance release for major flagship models as part of monthly Security Maintenance Release (SMR) process. This Security Update package includes patches from Google and Samsung.

The following CVE items from September 2017 Android Security Bulletin are included in this Security Update package:

Critical

CVE-2016-9794, CVE-2017-0756, CVE-2017-0757, CVE-2017-0758, CVE-2017-0759, CVE-2017-0760, CVE-2017-0761, CVE-2017-0762, CVE-2017-0763, CVE-2017-0764, CVE-2017-0765, CVE-2016-0842

High

CVE-2014-9940, CVE-2017-0648, CVE-2017-10661, CVE-2017-0421, CVE-2017-0752, CVE-2017-6983, CVE-2017-0755, CVE-2017-0767, CVE-2017-0768, CVE-2017-0769, CVE-2017-0770, CVE-2017-0771, CVE-2017-0772, CVE-2017-0773, CVE-2017-0774, CVE-2017-0775, CVE-2017-0776, CVE-2017-0777, CVE-2017-0778, CVE-2017-0670, CVE-2016-6712

Moderate

CVE-2017-0537, CVE-2017-0586, CVE-2017-8242, CVE-2017-8259, CVE-2017-8260, CVE-2017-8261, CVE-2017-8265, CVE-2017-8270, CVE-2017-0742, CVE-2017-9682, CVE-2017-0779, CVE-2017-0784

Low

CVE-2017-0650

Already included in previous updates

CVE-2017-8254, CVE-2014-9971, CVE-2014-9972, CVE-2014-9976, CVE-2015-0574, CVE-2015-8593, CVE-2015-8594, CVE-2015-9063, CVE-2015-9064, CVE-2015-9065, CVE-2016-10384, CVE-2016-10386

Not applicable to Samsung devices

CVE-2016-10385, CVE-2016-10390, CVE-2017-0750, CVE-2017-10662, CVE-2017-10663, CVE-2017-0741, CVE-2017-0753, CVE-2017-0766, CVE-2017-0780

※ Please see Android Security Bulletin for detailed information on Google patches.

Along with Google patches, Samsung Mobile provides 12 Samsung Vulnerabilities and Exposures (SVE) items described below, in order to improve our customer's confidence on security of Samsung Mobile devices. Some of the SVE items may not be included in this package, in case these items were already included in a previous maintenance release.

SVE-2017-9299: Arbitrary code execution with svoice privileges

Severity: High

Affected versions: M(6.0), N(7.x)

Reported on: May 22, 2017

Disclosure status: Privately disclosed.

A vulnerability in SVoice allows attackers to modify dynamic libraries included in the app, resulting in arbitrary code execution as SVoice privilege.

The patch prevents access to dynamic libraries.

SVE-2017-9357: Email can be sent by malicious application via unprotected component

Severity: Low

Affected versions: KK(4.4), L(5.0/5.1), M(6.0), N(7.x)

Reported on: May 27, 2017

Disclosure status: Privately disclosed.

An unprotected component of Samsung Email application allows attackers to send emails with user’s account without any user interactions.

The patch restricts the senders capable of broadcasting the intent by permission.

SVE-2017-9659: Security authentication reset issue without user confirmation

Severity: Moderate

Affected versions: M(6.0), N(7.0, 7.1)

Reported on: July 05, 2017

Disclosure status: Privately disclosed.

A vulnerability allows attackers to register a new security certificate without user authentication.

The patch addressed the issue.

Some SVE items included in the Samsung Android Security Update cannot be disclosed at this time.

Acknowledgements

We truely appreciate the following researchers for helping Samsung to improve the security of our products.

- MOULU Andre : SVE-2017-9299

- Yousra Aafer of Purdue University : SVE-2017-9357

- Qing Zhang of Xiaomi and Guangdong Bai of Singapore Institute of Technology (SIT) : SVE-2017-9659