CVE-2015-4640 Other in n/a
Man-in-the-middle attackers can modify language-pack files via HTTP, potentially leading to code execution when combined with another vulnerability.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2015-4640?
CVE-2015-4640 is a low-severity vulnerability in n/a, published on 19 Jun 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The SwiftKey language-pack update implementation on Samsung Galaxy S4, S4 Mini, S5, and S6 devices relies on an HTTP connection to the skslm.swiftkey.net server, which allows man-in-the-middle attackers to write to language-pack files by modifying an HTTP response. NOTE: CVE-2015-4640 exploitation can be combined with CVE-2015-4641 exploitation for man-in-the-middle code execution.
Weakness: CWE-254
Which versions are affected by CVE-2015-4640?
It affects 1 product.
Products include Swiftkey Swiftkey Sdk.
How do I fix CVE-2015-4640?
No fix has been published for CVE-2015-4640 yet. Limit exposure of the affected software until one is available.
Is CVE-2015-4640 being exploited?
There is no known exploitation of CVE-2015-4640 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-vvp6-3cxw-w3p7.