CVE-2015-7946 MTP service exposed during emergency dialer

High 7.3 Published 7 May 2020 Updated 16 Sep 2024

An attacker can expose the MTP service by opening the emergency dialer, potentially allowing unauthorized data access on Ubuntu phones.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2015-7946?

CVE-2015-7946 is a high-severity vulnerability in Canonical unity8 (Ubuntu), published on 7 May 2020. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Information Exposure vulnerability in Unity8 as used on the Ubuntu phone and possibly also in Unity8 shipped elsewhere. This allows an attacker to enable the MTP service by opening the emergency dialer. Fixed in 8.11+16.04.20160111.1-0ubuntu1 and 8.11+15.04.20160122-0ubuntu1.

Weakness: CWE-200

Which versions are affected by CVE-2015-7946?

It affects 1 product.

Products include Ubports Unity8.

How do I fix CVE-2015-7946?

No fix has been published for CVE-2015-7946 yet. Limit exposure of the affected software until one is available.

Is CVE-2015-7946 being exploited?

There is no known exploitation of CVE-2015-7946 in the wild and no public exploit code.

CVE-2016-1573 Using a specially crafted fallback art property, scopes can execute arbitrary QML code in context of unity8-dash Medium 4.8

Sources

Also known as GHSA-8x99-rqcq-6fvg.