CVE-2018-16266
First published: Wed Jan 22 2020(Updated: )
The Enlightenment system service in Tizen allows an unprivileged process to fully control or capture windows, due to improper D-Bus security policy configurations. This affects Tizen before 5.0 M1, and Tizen-based firmwares including Samsung Galaxy Gear series before build RE2.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux Tizen | =1.0 | |
| Linux Tizen | =1.0-m1 | |
| Linux Tizen | =2.0 | |
| Linux Tizen | =2.1 | |
| Linux Tizen | =2.2 | |
| Linux Tizen | =2.2.1 | |
| Linux Tizen | =2.3 | |
| Linux Tizen | =2.3.1 | |
| Linux Tizen | =2.4 | |
| Linux Tizen | =3.0 | |
| Linux Tizen | =3.0-m2 | |
| Linux Tizen | =3.0-m3 | |
| Linux Tizen | =4.0-m1 | |
| Linux Tizen | =4.0-m2 | |
| Linux Tizen | =4.0-m3 | |
| Linux Tizen | =5.0 | |
| Samsung Galaxy Gear |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://media.defcon.org/DEF%20CON%2026/DEF%20CON%2026%20presentations/Dongsung%20Kim%20and%20Hyoung%20Kee%20Choi%20-%20Updated/DEFCON-26-Dongsung-Kim-and-Hyoung-Kee-Choi-Your-Watch-Can-Watch-You-Updated.pdf
- https://review.tizen.org/git/?p=platform/upstream/enlightenment.git;a=commit;h=8ff5c24d04f97b1c84b463535876600b22128fb4
- https://www.youtube.com/watch?v=3IdgBwbOT-g&feature=youtu.be
- https://review.tizen.org/git/?p=platform/upstream/enlightenment.git%3Ba=commit%3Bh=8ff5c24d04f97b1c84b463535876600b22128fb4
Frequently Asked Questions
What is the vulnerability ID?
CVE-2018-16266
What is the severity of CVE-2018-16266?
The severity of CVE-2018-16266 is high with a severity value of 8.1.
How does CVE-2018-16266 affect Tizen-based firmwares?
CVE-2018-16266 affects Tizen-based firmwares including Samsung Galaxy Gear series before build RE2.
How can an unprivileged process fully control or capture windows in Tizen?
An unprivileged process can fully control or capture windows in Tizen due to improper D-Bus security policy configurations.
Are there any references available for CVE-2018-16266?
Yes, you can refer to the following links for more information on CVE-2018-16266: [Link 1](https://media.defcon.org/DEF%20CON%2026/DEF%20CON%2026%20presentations/Dongsung%20Kim%20and%20Hyoung%20Kee%20Choi%20-%20Updated/DEFCON-26-Dongsung-Kim-and-Hyoung-Kee-Choi-Your-Watch-Can-Watch-You-Updated.pdf), [Link 2](https://review.tizen.org/git/?p=platform/upstream/enlightenment.git;a=commit;h=8ff5c24d04f97b1c84b463535876600b22128fb4), [Link 3](https://www.youtube.com/watch?v=3IdgBwbOT-g&feature=youtu.be)
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/author
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/remedy
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/linux
- canonical/linux tizen
- version/linux tizen/1.0
- version/linux tizen/1.0-m1
- version/linux tizen/2.0
- version/linux tizen/2.1
- version/linux tizen/2.2
- version/linux tizen/2.2.1
- version/linux tizen/2.3
- version/linux tizen/2.3.1
- version/linux tizen/2.4
- version/linux tizen/3.0
- version/linux tizen/3.0-m2
- version/linux tizen/3.0-m3
- version/linux tizen/4.0-m1
- version/linux tizen/4.0-m2
- version/linux tizen/4.0-m3
- version/linux tizen/5.0
- vendor/samsung
- canonical/samsung galaxy gear