CVE-2018-16263: High severity tizen vulnerability

Published Jan 22, 2020

Updated

The PulseAudio system service in Tizen allows an unprivileged process to control its A2DP MediaEndpoint, due to improper D-Bus security policy configurations. This affects Tizen before 5.0 M1, and Tizen-based firmwares including Samsung Galaxy Gear series before build RE2.

Affected Software

17 affected components

Linux Tizen=1.0

Linux Tizen=1.0-m1

Linux Tizen=2.0

Linux Tizen=2.1

Linux Tizen=2.2

Linux Tizen=2.2.1

Linux Tizen=2.3

Linux Tizen=2.3.1

Linux Tizen=2.4

Linux Tizen=3.0

Linux Tizen=3.0-m2

Linux Tizen=3.0-m3

Linux Tizen=4.0-m1

Linux Tizen=4.0-m2

Linux Tizen=4.0-m3

Linux Tizen=5.0

Samsung Galaxy Gear

Remediation

Patch Available

https://review.tizen.org/git/?p=platform/upstream/pulseaudio.git;a=commit;h=81e8ba9f3ab0917da4fdfa094f49333be57964c6

Event History

Jan 22, 2020

CVE Published

via MITRE·12:41 PM

Data Sourced

via MITRE·12:41 PM

Description

Frequently Asked Questions

What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2018-16263.

What is the severity of CVE-2018-16263?

The severity of CVE-2018-16263 is high with a severity value of 8.8.

Which software is affected by CVE-2018-16263?

Linux Tizen versions before 5.0 M1 and Tizen-based firmwares including Samsung Galaxy Gear series before build RE2 are affected by CVE-2018-16263.

What is the impact of CVE-2018-16263?

CVE-2018-16263 allows an unprivileged process to control the A2DP MediaEndpoint of the PulseAudio system service in Tizen, leading to unauthorized control of audio streaming.

Are there any references available for CVE-2018-16263?

Yes, you can find references for CVE-2018-16263 at the following links: [1] [2] [3].