CVE-2016-2036 Null dereference in n/a

Medium 5.5 Published 13 Apr 2017 Updated 5 Aug 2024

Attackers can cause a denial of service on Samsung Android devices by triggering a NULL pointer dereference in the kernel's URL parser.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2016-2036?

CVE-2016-2036 is a medium-severity vulnerability in n/a, published on 13 Apr 2017. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The getURL function in drivers/secfilter/urlparser.c in secfilter in the Samsung kernel for Android on SM-N9005 build N9005XXUGBOB6 (Note 3) and SM-G920F build G920FXXU2COH2 (Galaxy S6) devices allows attackers to trigger a NULL pointer dereference via a "GET HTTP/1.1" request, aka SVE-2016-5036.

Weakness: CWE-476

Which versions are affected by CVE-2016-2036?

It affects 2 products.

Products include Samsung Galaxy Note 3 Firmware, Samsung Galaxy S6 Firmware.

How do I fix CVE-2016-2036?

No fix has been published for CVE-2016-2036 yet. Limit exposure of the affected software until one is available.

Is CVE-2016-2036 being exploited?

There is no known exploitation of CVE-2016-2036 in the wild and no public exploit code.

Sources

Also known as GHSA-3xp5-x55c-8fj2.