CVE-2012-2980 The Samsung and HTC onTouchEvent method implementation for Android on the T-Mobile myTouch 3G Slide, HTC Merge, Sprint EVO Shift 4G, HTC ChaCha, AT&T Status, HTC Desire Z, T-Mobile G2, T-Mobile myTouc...
HighCVSS 7.1
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Samsung and HTC onTouchEvent method implementation for Android on the T-Mobile myTouch 3G Slide, HTC Merge, Sprint EVO Shift 4G, HTC ChaCha, AT&T Status, HTC Desire Z, T-Mobile G2, T-Mobile myTouch 4G Slide, and Samsung Galaxy S stores touch coordinates in the dmesg buffer, which allows remote attackers to obtain sensitive information via a crafted application, as demonstrated by PIN numbers, telephone numbers, and text messages.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| att status | All versions | No fix listed |
| htc chacha | All versions | No fix listed |
| htc desire | All versions | No fix listed |
| htc merge | All versions | No fix listed |
| samsung galaxy s | All versions | No fix listed |
| sprint evo shift 4g | All versions | No fix listed |
| t-mobile g2 | All versions | No fix listed |
| t-mobile mytouch 3g slide | All versions | No fix listed |
| t-mobile mytouch 4g slide | All versions | No fix listed |
References
- www.htc.com
- VU#251635 third-party-advisory us-government-resource
- www.kb.cert.org