CVE-2018-16267: High severity tizen vulnerability

Published Jan 22, 2020

Updated

The system-popup system service in Tizen allows an unprivileged process to perform popup-related system actions, due to improper D-Bus security policy configurations. Such actions include the triggering system poweroff menu, and prompting a popup with arbitrary strings. This affects Tizen before 5.0 M1, and Tizen-based firmwares including Samsung Galaxy Gear series before build RE2.

Affected Software

17 affected components

Linux Tizen=1.0

Linux Tizen=1.0-m1

Linux Tizen=2.0

Linux Tizen=2.1

Linux Tizen=2.2

Linux Tizen=2.2.1

Linux Tizen=2.3

Linux Tizen=2.3.1

Linux Tizen=2.4

Linux Tizen=3.0

Linux Tizen=3.0-m2

Linux Tizen=3.0-m3

Linux Tizen=4.0-m1

Linux Tizen=4.0-m2

Linux Tizen=4.0-m3

Linux Tizen=5.0

Samsung Galaxy Gear

Remediation

Patch Available

https://review.tizen.org/git/?p=platform/core/system/system-popup.git;a=commit;h=57b3c2f3cd61c6f432e7abe3a2d8b0df72fd4b0e

Event History

Jan 22, 2020

CVE Published

via MITRE·12:49 PM

Data Sourced

via MITRE·12:49 PM

Description

Frequently Asked Questions

What is CVE-2018-16267?

CVE-2018-16267 is a vulnerability in the Tizen operating system that allows an unprivileged process to perform popup-related system actions.

What is the severity of CVE-2018-16267?

CVE-2018-16267 has a severity rating of 8.1 (high).

How does CVE-2018-16267 affect Tizen?

CVE-2018-16267 affects Tizen versions before 5.0.

What actions can an attacker perform with CVE-2018-16267?

An attacker can trigger the system poweroff menu and prompt a popup with arbitrary strings using CVE-2018-16267.

How can I fix CVE-2018-16267?

To fix CVE-2018-16267, update your Tizen operating system to version 5.0 or a higher version.