2.9
CWE
254
Advisory Published
Updated

CVE-2015-4640

First published: Fri Jun 19 2015(Updated: )

The SwiftKey language-pack update implementation on Samsung Galaxy S4, S4 Mini, S5, and S6 devices relies on an HTTP connection to the skslm.swiftkey.net server, which allows man-in-the-middle attackers to write to language-pack files by modifying an HTTP response. NOTE: CVE-2015-4640 exploitation can be combined with CVE-2015-4641 exploitation for man-in-the-middle code execution.

Credit: cve@mitre.org

Affected SoftwareAffected VersionHow to fix
SwiftKey
Samsung Galaxy S4
Samsung Galaxy S4 Mini
Samsung Galaxy S5
Samsung Galaxy S6 Firmware

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Frequently Asked Questions

  • What is the severity of CVE-2015-4640?

    CVE-2015-4640 is considered a high severity vulnerability due to its potential for remote exploitation.

  • How do I fix CVE-2015-4640?

    To mitigate CVE-2015-4640, ensure that your device is updated to the latest firmware which addresses this vulnerability.

  • Which devices are affected by CVE-2015-4640?

    CVE-2015-4640 affects Samsung Galaxy S4, S4 Mini, S5, and S6 devices using the SwiftKey SDK.

  • What type of attack can exploit CVE-2015-4640?

    CVE-2015-4640 can be exploited through man-in-the-middle attacks that modify the HTTP response from the SwiftKey update server.

  • What are the potential consequences of CVE-2015-4640?

    Exploitation of CVE-2015-4640 can allow attackers to write malicious language-pack files to compromised devices.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203