Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2016-10135

Опубликовано: 13 янв. 2017
Источник: nvd
CVSS3: 5.5
CVSS2: 4.3
EPSS Низкий

Описание

An issue was discovered on LG devices using the MTK chipset with L(5.0/5.1), M(6.0/6.0.1), and N(7.0) software, and RCA Voyager Tablet, BLU Advance 5.0, and BLU R1 HD devices. The MTKLogger app with a package name of com.mediatek.mtklogger has application components that are accessible to any application that resides on the device. Namely, the com.mediatek.mtklogger.framework.LogReceiver and com.mediatek.mtklogger.framework.MTKLoggerService application components are exported since they contain an intent filter, are not protected by a custom permission, and do not explicitly set the android:exported attribute to false. Therefore, these components are exported by default and are thus accessible to any third party application by using android.content.Intent object for communication. These application components can be used to start and stop the logs using Intent objects with embedded data. The available logs are the GPS log, modem log, network log, and mobile log. The base directory that

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:lg:lg_mobile:5.0:*:*:*:*:*:*:*
cpe:2.3:o:lg:lg_mobile:5.1:*:*:*:*:*:*:*
cpe:2.3:o:lg:lg_mobile:6.0:*:*:*:*:*:*:*
cpe:2.3:o:lg:lg_mobile:6.0.1:*:*:*:*:*:*:*
cpe:2.3:o:lg:lg_mobile:7.0:*:*:*:*:*:*:*

EPSS

Процентиль: 45%
0.00226
Низкий

5.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-200

Связанные уязвимости

CVSS3: 5.5
github
больше 3 лет назад

An issue was discovered on LG devices using the MTK chipset with L(5.0/5.1), M(6.0/6.0.1), and N(7.0) software, and RCA Voyager Tablet, BLU Advance 5.0, and BLU R1 HD devices. The MTKLogger app with a package name of com.mediatek.mtklogger has application components that are accessible to any application that resides on the device. Namely, the com.mediatek.mtklogger.framework.LogReceiver and com.mediatek.mtklogger.framework.MTKLoggerService application components are exported since they contain an intent filter, are not protected by a custom permission, and do not explicitly set the android:exported attribute to false. Therefore, these components are exported by default and are thus accessible to any third party application by using android.content.Intent object for communication. These application components can be used to start and stop the logs using Intent objects with embedded data. The available logs are the GPS log, modem log, network log, and mobile log. The base directory t...

EPSS

Процентиль: 45%
0.00226
Низкий

5.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-200