CVE-2024-49415
Apache Synamap Out-of-Bound Write Buffer Overflow Vulnerability
Description
Out-of-bound write in libsaped.so prior to SMR Dec-2024 Release 1 allows remote attackers to execute arbitrary code.
INFO
Published Date :
Dec. 3, 2024, 6:15 a.m.
Last Modified :
Dec. 3, 2024, 6:15 a.m.
Source :
[email protected]
Remotely Exploitable :
Yes !
Impact Score :
5.9
Exploitability Score :
2.2
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2024-49415.
| URL | Resource |
|---|---|
| https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=12 |
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2024-49415 vulnerability anywhere in the article.
-
TheCyberThrone
CVE-2024-44243: macOS SIP Bypass Flaw
CVE-2024-44243 is a critical vulnerability discovered in macOS that allows attackers to bypass Apple’s System Integrity Protection (SIP) by exploiting third-party kernel extensions. This vulnerability ... Read more
-
TheCyberThrone
Google Chrome fixes 16 flaws with the latest version
Google has released version 132.0.6834.83/84 of its Chrome browser on January 14, 2025. This update addresses several critical security vulnerabilities to enhance the browser’s security and stability. ... Read more
-
TheCyberThrone
CISA adds Fortinet flaw CVE-2024-55591 to KEV Catalog
CVE-2024-55591 is a critical vulnerability affecting Fortinet’s FortiOS and FortiProxy devices. This vulnerability allows a remote attacker to bypass authentication mechanisms and gain super-admin pri ... Read more
-
TheCyberThrone
Microsoft Patch Tuesday- January 2025
Microsoft released the January 2025 Patch Tuesday updates on January 14, 2025, focusing on addressing critical security vulnerabilities across various Microsoft products. This update cycle includes se ... Read more
-
TheCyberThrone
CVE-2024-12398 impacts Zyxel Devices
CVE-2024-12398 is a critical vulnerability discovered in the web management interface of certain Zyxel devices. This vulnerability allows an authenticated user with limited privileges to escalate thei ... Read more
-
TheCyberThrone
CISA KEV Catalog Update Part III- January 2025
The US CISA has recently included two significant vulnerabilities, CVE-2024-12686 and CVE-2023-48365, in its Known Exploited Vulnerabilities (KEV) Catalog. This catalog is an essential resource for or ... Read more
-
TheCyberThrone
CVE-2024-54498: Exploit Code Released for macOS Flaw
OverviewCVE-2024-54498 is a critical vulnerability affecting macOS systems, specifically those running versions prior to 2.6.11. This vulnerability, discovered by security researcher @wh1te4ever, invo ... Read more
-
Cybersecurity News
New macOS Exploit Revealed: PoC for CVE-2024-54498 Breaks Sandbox Security
Recently, security researcher @wh1te4ever has revealed a proof of concept (PoC) exploit for CVE-2024-54498, a vulnerability that allows applications to escape the confines of the macOS Sandbox. The Po ... Read more
-
Cybersecurity News
0-Click Vulnerability in Samsung S24 Devices: PoC Releases for CVE-2024-49415
A newly published report from Natalie Silvanovich, a security researcher at Google’s Project Zero team, has revealed a critical vulnerability in the Monkey’s Audio (APE) decoder used in Samsung’s S24 ... Read more
-
TheCyberThrone
TheCyberThrone Security Weekly Review – January 11, 2025
Welcome to TheCyberThrone cybersecurity week in review will be posted covering the important security happenings. This review is for the week ending Saturday, January 11, 2025.Redis was affected by CV ... Read more
-
TheCyberThrone
Chinese MirrorFace APT targets Japan
The MirrorFace Advanced Persistent Threat (APT) group, also known as Earth Kasha, has been linked to a series of cyber-attacks targeting Japan. These attacks have been ongoing since 2019 and have prim ... Read more
-
TheCyberThrone
CVE-2024-5594 impacts OpenVPN
CVE-2024-5594 is a critical vulnerability identified in OpenVPN versions prior to 2.6.11. This vulnerability stems from improper sanitization of PUSH_REPLY messages, which allows attackers to inject u ... Read more
-
TheCyberThrone
CVE-2024-49415 : Samsung Android devices Impacted
CVE-2024-49415 is a critical vulnerability found in Samsung devices running Android versions 12, 13, and 14. This vulnerability was discovered by researchers from Google Project Zero, a team dedicated ... Read more
-
The Hacker News
Google Project Zero Researcher Uncovers Zero-Click Exploit Targeting Samsung Devices
Cybersecurity researchers have detailed a now-patched security flaw impacting Monkey's Audio (APE) decoder on Samsung smartphones that could lead to code execution. The high-severity vulnerability, tr ... Read more
The following table lists the changes that have been made to the
CVE-2024-49415 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by [email protected]
Dec. 03, 2024
Action Type Old Value New Value Added Description Out-of-bound write in libsaped.so prior to SMR Dec-2024 Release 1 allows remote attackers to execute arbitrary code. Added CVSS V3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Added Reference https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=12
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2024-49415 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2024-49415
weaknesses.