CVE-2020-8899

Description

There is a buffer overwrite vulnerability in the Quram qmg library of Samsung's Android OS versions O(8.x), P(9.0) and Q(10.0). An unauthenticated, unauthorized attacker sending a specially crafted MMS to a vulnerable phone can trigger a heap-based buffer overflow in the Quram image codec leading to an arbitrary remote code execution (RCE) without any user interaction. The Samsung ID is SVE-2020-16747.

Weakness classification

• cve-coordination@google.com: CWE-122
• nvd@nist.gov: CWE-787

Primary references

• cve-coordination@google.com — Third Party Advisory, VDB Entry
• cve-coordination@google.com — Exploit, Issue Tracking, Third Party Advisory
• cve-coordination@google.com — Vendor Advisory
• cve-coordination@google.com — Third Party Advisory, US Government Resource
• af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Issue Tracking, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, US Government Resource