CVE-2018-16262: High severity tizen vulnerability
The pkgmgr system service in Tizen allows an unprivileged process to perform package management actions, due to improper D-Bus security policy configurations. Such actions include installing, decrypting, and killing other packages. This affects Tizen before 5.0 M1, and Tizen-based firmwares including Samsung Galaxy Gear series before build RE2.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2018-16262?
CVE-2018-16262 is a vulnerability in the pkgmgr system service in Tizen that allows an unprivileged process to perform package management actions.
What is the severity of CVE-2018-16262?
The severity of CVE-2018-16262 is high with a severity value of 8.8.
Which software versions are affected by CVE-2018-16262?
CVE-2018-16262 affects Tizen before 5.0 M1, and Tizen-based firmwares including 1.0, 1.0-m1, 2.0, 2.1, 2.2, 2.2.1, 2.3, 2.3.1, 2.4, 3.0, 3.0-m2, 3.0-m3, 4.0-m1, 4.0-m2, 4.0-m3, and 5.0.
How can an unprivileged process exploit CVE-2018-16262?
An unprivileged process can exploit CVE-2018-16262 by performing package management actions, such as installing, decrypting, and killing other packages.
Where can I find more information about CVE-2018-16262?
More information about CVE-2018-16262 can be found at the following references: [link 1](https://media.defcon.org/DEF%20CON%2026/DEF%20CON%2026%20presentations/Dongsung%20Kim%20and%20Hyoung%20Kee%20Choi%20-%20Updated/DEFCON-26-Dongsung-Kim-and-Hyoung-Kee-Choi-Your-Watch-Can-Watch-You-Updated.pdf), [link 2](https://review.tizen.org/git/?p=platform/core/appfw/pkgmgr-server.git;a=commit;h=aac8a95859828a058d8e06893982b11ebc81dd78), [link 3](https://www.youtube.com/watch?v=3IdgBwbOT-g&feature=youtu.be).