Sign-up

ID

VAR-201601-0432


CVE

CVE-2015-8225


TITLE

Huawei ALE and GEM-703L Smartphone software JPU Service disruption in drivers (DoS) Vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2015-006751

DESCRIPTION

The Joint Photographic Experts Group Processing Unit (JPU) driver in Huawei ALE smartphones with software before ALE-UL00C00B220 and ALE-TL00C01B220 and GEM-703L smartphones with software before V100R001C233B111 allows remote attackers to cause a denial of service (crash) via a crafted application with the system or camera permission, a different vulnerability than CVE-2015-8226. HuaweiALEsmartphone and GEM-703Lsmartphone are all Huawei smartphones of China. JointPhotographicExpertsGroupProcessingUnit (JPU) is one of the drivers. There is a security hole in the JPU driver of HuaweiALE and GEM-703L smartphones. Multiple Huawei JPU products are prone to multiple denial-of-service vulnerabilities. Other attacks are also possible. The following versions are affected: Huawei ALE using software versions earlier than ALE-UL00C00B220 and ALE-TL00C01B220, and GEM-703L using software versions earlier than V100R001C233B111

Trust: 2.52

sources: NVD: CVE-2015-8225 // JVNDB: JVNDB-2015-006751 // CNVD: CNVD-2016-00177 // BID: 80353 // VULHUB: VHN-86186

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2016-00177

AFFECTED PRODUCTS

vendor:huaweimodel:gem-703lscope:eqversion: -

Trust: 1.6

vendor:huaweimodel:alescope:eqversion: -

Trust: 1.6

vendor:huaweimodel:alescope:ltversion:ale-tl00c01b220

Trust: 0.8

vendor:huaweimodel:alescope:ltversion:ale-ul00c00b220

Trust: 0.8

vendor:huaweimodel:gem-703lscope:ltversion:v100r001c233b111

Trust: 0.8

vendor:huaweimodel:ale smartphone and gem-703l smartphonescope: - version: -

Trust: 0.6

vendor:huaweimodel:gem-703lscope:eqversion:0

Trust: 0.3

vendor:huaweimodel:alescope:eqversion:0

Trust: 0.3

vendor:huaweimodel:gem-703l v100r001c233b111scope:neversion: -

Trust: 0.3

vendor:huaweimodel:ale ale-ul00c00b220scope:neversion: -

Trust: 0.3

vendor:huaweimodel:ale ale-tl00c01b220scope:neversion: -

Trust: 0.3

sources: CNVD: CNVD-2016-00177 // BID: 80353 // JVNDB: JVNDB-2015-006751 // CNNVD: CNNVD-201601-132 // NVD: CVE-2015-8225

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2015-8225
value: MEDIUM

Trust: 1.0

NVD: CVE-2015-8225
value: HIGH

Trust: 0.8

CNVD: CNVD-2016-00177
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201601-132
value: HIGH

Trust: 0.6

VULHUB: VHN-86186
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2015-8225
severity: HIGH
baseScore: 7.1
vectorString: AV:N/AC:M/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2016-00177
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-86186
severity: HIGH
baseScore: 7.1
vectorString: AV:N/AC:M/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2015-8225
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 3.6
version: 3.0

Trust: 1.0

sources: CNVD: CNVD-2016-00177 // VULHUB: VHN-86186 // JVNDB: JVNDB-2015-006751 // CNNVD: CNNVD-201601-132 // NVD: CVE-2015-8225

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.9

sources: VULHUB: VHN-86186 // JVNDB: JVNDB-2015-006751 // NVD: CVE-2015-8225

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201601-132

TYPE

input validation

Trust: 0.6

sources: CNNVD: CNNVD-201601-132

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2015-006751

PATCH
title:Huawei-SA-20151210-01-JPUurl:http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-465532.htm
Trust: 0.8
title:HuaweiALE and GEM-703LJointPhotographicExpertsGroupProcessingUnit denial of service vulnerability patchurl:https://www.cnvd.org.cn/patchInfo/show/69870
Trust: 0.6
title:Huawei ALE  and GEM-703L Joint Photographic Experts Group Processing Unit Enter the fix for the verification vulnerabilityurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=59487
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2016-00177 // 
            
            
            
            JVNDB: JVNDB-2015-006751 // 
            
            
            
            CNNVD: CNNVD-201601-132

EXTERNAL IDS
db:NVDid:CVE-2015-8225
Trust: 3.4
db:JVNDBid:JVNDB-2015-006751
Trust: 0.8
db:CNNVDid:CNNVD-201601-132
Trust: 0.7
db:CNVDid:CNVD-2016-00177
Trust: 0.6
db:BIDid:80353
Trust: 0.3
db:VULHUBid:VHN-86186
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2016-00177 // 
            
            
            
            VULHUB: VHN-86186 // 
            
            
            
            BID: 80353 // 
            
            
            
            JVNDB: JVNDB-2015-006751 // 
            
            
            
            CNNVD: CNNVD-201601-132 // 
            
            
            
            NVD: CVE-2015-8225

REFERENCES
url:http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-465532.htm
Trust: 2.3
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-8225
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-8225
Trust: 0.8
url:http://www.huawei.com
Trust: 0.3
url:http://www.huawei.com/en/psirt/security-advisories/hw-465532
Trust: 0.3
sources:
            
            
            CNVD: CNVD-2016-00177 // 
            
            
            
            VULHUB: VHN-86186 // 
            
            
            
            BID: 80353 // 
            
            
            
            JVNDB: JVNDB-2015-006751 // 
            
            
            
            CNNVD: CNNVD-201601-132 // 
            
            
            
            NVD: CVE-2015-8225

CREDITS
Gengjia Chen (@jiayy) of Lab 0x031E of Qihoo 360 Technology Co. Ltd.
Trust: 0.3
sources:
            
            
            BID: 80353

SOURCES
db:CNVDid:CNVD-2016-00177
db:VULHUBid:VHN-86186
db:BIDid:80353
db:JVNDBid:JVNDB-2015-006751
db:CNNVDid:CNNVD-201601-132
db:NVDid:CVE-2015-8225

LAST UPDATE DATE
2025-04-12T23:18:45.396000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2016-00177date:2016-01-13T00:00:00
db:VULHUBid:VHN-86186date:2016-01-14T00:00:00
db:BIDid:80353date:2015-12-10T00:00:00
db:JVNDBid:JVNDB-2015-006751date:2016-01-14T00:00:00
db:CNNVDid:CNNVD-201601-132date:2016-01-15T00:00:00
db:NVDid:CVE-2015-8225date:2025-04-12T10:46:40.837

SOURCES RELEASE DATE
db:CNVDid:CNVD-2016-00177date:2016-01-13T00:00:00
db:VULHUBid:VHN-86186date:2016-01-08T00:00:00
db:BIDid:80353date:2015-12-10T00:00:00
db:JVNDBid:JVNDB-2015-006751date:2016-01-14T00:00:00
db:CNNVDid:CNNVD-201601-132date:2016-01-11T00:00:00
db:NVDid:CVE-2015-8225date:2016-01-08T19:59:10.130