vulnwire
5.3med

CVE-2018-107511 exploit

A malformed OMACP WAP push message can cause memory corruption on a Samsung S7 Edge device when processing the String Extension portion of…

Published 8 y ago · modified 4 mo ago · JSON

CVSS
5.3
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
8.7%
percentile 95%
Public exploits
1
Exploit-DB

A malformed OMACP WAP push message can cause memory corruption on a Samsung S7 Edge device when processing the String Extension portion of the WbXml payload. This is due to an integer overflow in memory allocation for this string. The Samsung ID is SVE-2018-11463.

Exploit prediction (EPSS)

8.73% probability of exploitation in the next 30 days, higher than 95% of all scored CVEs.

Exploits and detections

  • EDB-44724 Samsung Galaxy S7 Edge - Overflow in OMACP WbXml String Extension Processing · dos · 2018-05-23

CVSS scores

Assigned byVersionScoreVector
NVD3.05.3CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
NVD2.05.4AV:N/AC:H/Au:N/C:N/I:N/A:C

Classification

Weakness
  • CWE-190 Integer Overflow or Wraparound

References

  • exploit-db.com /exploits/44724/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • packetstormsecurity.com /files/147841/Samsung-Galaxy-S7-Edge-OMACP-WbXml-String-Extension-Processing-Overflow.html · x_refsource_MISC, x_transferred
  • security.samsungmobile.com /securityUpdate.smsb · x_refsource_CONFIRM, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.