Samsung Security Bulletin: Multiple Vulnerabilities in SmartThings, Health, GoodLock (CVE-2024-34596-34601)

Critical Vulnerability Information July 2024 Update SVE-2023-2192 (CVE-2024-34596): Improper Authentication in SmartThings - Severity: Medium - Fixed Version: 1.8.17 - Report Date: December 1, 2023 - Description: In versions of SmartThings prior to 1.8.17, a remote attacker could bypass the expiration date set for member settings. - Fix: Added appropriate check logic. SVE-2024-0458 (CVE-2024-34597): Improper Input Validation in Samsung Health - Severity: Medium - Fixed Version: 6.27.0.17 - Report Date: January 23, 2024 - Description: In versions of Samsung Health prior to 6.2.0.016, a local attacker could write arbitrary document files into the Samsung Health sandbox. - Fix: Added appropriate caller validation logic. SVE-2024-0975 (CVE-2024-34598): Improper Component Export in GoodLock - Severity: High - Fixed Version: 2.2.04.95 - Report Date: April 20, 2024 - Description: In versions of GoodLock prior to 2.2.04.95, a local attacker could install any application from the Galaxy Store. - Fix: Added appropriate access control. SVE-2024-0974 (CVE-2024-34599): Improper Input Validation in Tips - Severity: Medium - Fixed Version: 6.2.9.4 - Report Date: April 20, 2024 - Description: In versions of Tips for Android 14 prior to 6.2.9.4, a local attacker could send broadcasts with Tips permissions. - Fix: Removed unused code. SVE-2024-0985 (CVE-2024-34600): Broadcast Receiver Vulnerability in Samsung Flow - Severity: Medium - Fixed Version: 4.013.0 - Report Date: April 20, 2024 - Description: In versions of Samsung Flow prior to 4.013.0, a local attacker could copy image files to external storage. - Fix: Added appropriate caller validation logic. SVE-2024-1172 (CVE-2024-34601): Broadcast Receiver Vulnerability in GalaxyStore - Severity: Medium - Fixed Version: 4.5.81.0 - Report Date: May 21, 2024 - Description: In versions of GalaxyStore prior to 4.5.81.0, a local attacker could launch an unexported activity. - Fix: Added appropriate caller validation logic.

Goal Reached Thanks to every supporter — we hit 100%!

Samsung Security Bulletin: Multiple Vulnerabilities in SmartThings, Health, GoodLock (CVE-2024-34596-34601)