Details of VAR-201601-0433

ID

VAR-201601-0433

CVE

CVE-2015-8226

TITLE

Huawei ALE and GEM-703L Smartphone software JPU Service disruption in drivers (DoS) Vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2015-006752

DESCRIPTION

The Joint Photographic Experts Group Processing Unit (JPU) driver in Huawei ALE smartphones with software before ALE-UL00C00B220 and ALE-TL00C01B220 and GEM-703L smartphones with software before V100R001C233B111 allows remote attackers to cause a denial of service (crash) via a crafted application with the system or camera permission, a different vulnerability than CVE-2015-8225. HuaweiALEsmartphone and GEM-703Lsmartphone are smartphones of China's Huawei company. JointPhotographicExpertsGroupProcessingUnit (JPU) is one of the drivers. A security vulnerability exists in the JPU driver of the HuaweiALEsmartphone and GEM-703Lsmartphone, allowing remote attackers to gain system or camera privileges through the use of specially crafted applications. Multiple Huawei JPU products are prone to multiple denial-of-service vulnerabilities. Attackers can exploit these issues to crash the application; denying service to legitimate users. Other attacks are also possible. A security vulnerability exists in the JPU driver of Huawei ALE and GEM-703L smartphones. The following versions are affected: Huawei ALE using software versions earlier than ALE-UL00C00B220 and ALE-TL00C01B220, and GEM-703L using software versions earlier than V100R001C233B111

Trust: 2.52

sources: NVD: CVE-2015-8226 // JVNDB: JVNDB-2015-006752 // CNVD: CNVD-2016-00311 // BID: 80353 // VULHUB: VHN-86187

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2016-00311

AFFECTED PRODUCTS

vendor:	huawei	model:	gem-703l	scope:	eq	version:	-	Trust: 1.6
vendor:	huawei	model:	ale	scope:	eq	version:	-	Trust: 1.6
vendor:	huawei	model:	ale	scope:	lt	version:	ale-tl00c01b220	Trust: 0.8
vendor:	huawei	model:	ale	scope:	lt	version:	ale-ul00c00b220	Trust: 0.8
vendor:	huawei	model:	gem-703l	scope:	lt	version:	v100r001c233b111	Trust: 0.8
vendor:	huawei	model:	ale smartphone and gem-703l smartphone	scope:	-	version:	-	Trust: 0.6
vendor:	huawei	model:	gem-703l	scope:	eq	version:	0	Trust: 0.3
vendor:	huawei	model:	ale	scope:	eq	version:	0	Trust: 0.3
vendor:	huawei	model:	gem-703l v100r001c233b111	scope:	ne	version:	-	Trust: 0.3
vendor:	huawei	model:	ale ale-ul00c00b220	scope:	ne	version:	-	Trust: 0.3
vendor:	huawei	model:	ale ale-tl00c01b220	scope:	ne	version:	-	Trust: 0.3

sources: CNVD: CNVD-2016-00311 // BID: 80353 // JVNDB: JVNDB-2015-006752 // CNNVD: CNNVD-201601-133 // NVD: CVE-2015-8226

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2015-8226
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2015-8226
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2016-00311
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-201601-133
value:	HIGH
Trust: 0.6
VULHUB:	VHN-86187
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2015-8226
severity:	HIGH
baseScore:	7.1
vectorString:	AV:N/AC:M/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.6
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2016-00311
severity:	HIGH
baseScore:	7.1
vectorString:	AV:N/AC:M/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.6
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-86187
severity:	HIGH
baseScore:	7.1
vectorString:	AV:N/AC:M/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.6
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2015-8226
baseSeverity:	MEDIUM
baseScore:	5.5
vectorString:	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	3.6
version:	3.0
Trust: 1.0

sources: CNVD: CNVD-2016-00311 // VULHUB: VHN-86187 // JVNDB: JVNDB-2015-006752 // CNNVD: CNNVD-201601-133 // NVD: CVE-2015-8226

PROBLEMTYPE DATA

problemtype:

CWE-20

Trust: 1.9

sources: VULHUB: VHN-86187 // JVNDB: JVNDB-2015-006752 // NVD: CVE-2015-8226

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201601-133

TYPE

input validation

Trust: 0.6

sources: CNNVD: CNNVD-201601-133

CONFIGURATIONS

sources: JVNDB: JVNDB-2015-006752

PATCH

title:	Huawei-SA-20151210-01-JPU	url:	http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-465532.htm	Trust: 0.8
title:	HuaweiALE and GEM-703LJointPhotographicExpertsGroupProcessingUnit denial of service vulnerability patch	url:	https://www.cnvd.org.cn/patchInfo/show/70148	Trust: 0.6
title:	Huawei ALE and GEM-703L Joint Photographic Experts Group Processing Unit Enter the fix for the verification vulnerability	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=59488	Trust: 0.6

sources: CNVD: CNVD-2016-00311 // JVNDB: JVNDB-2015-006752 // CNNVD: CNNVD-201601-133

EXTERNAL IDS

db:	NVD	id:	CVE-2015-8226	Trust: 3.4
db:	JVNDB	id:	JVNDB-2015-006752	Trust: 0.8
db:	CNNVD	id:	CNNVD-201601-133	Trust: 0.7
db:	CNVD	id:	CNVD-2016-00311	Trust: 0.6
db:	BID	id:	80353	Trust: 0.3
db:	VULHUB	id:	VHN-86187	Trust: 0.1

sources: CNVD: CNVD-2016-00311 // VULHUB: VHN-86187 // BID: 80353 // JVNDB: JVNDB-2015-006752 // CNNVD: CNNVD-201601-133 // NVD: CVE-2015-8226

REFERENCES

url:	http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-465532.htm	Trust: 2.3
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-8226	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-8226	Trust: 0.8
url:	http://www.huawei.com	Trust: 0.3
url:	http://www.huawei.com/en/psirt/security-advisories/hw-465532	Trust: 0.3

sources: CNVD: CNVD-2016-00311 // VULHUB: VHN-86187 // BID: 80353 // JVNDB: JVNDB-2015-006752 // CNNVD: CNNVD-201601-133 // NVD: CVE-2015-8226

CREDITS

Gengjia Chen (@jiayy) of Lab 0x031E of Qihoo 360 Technology Co. Ltd.

Trust: 0.3

sources: BID: 80353

SOURCES

db:	CNVD	id:	CNVD-2016-00311
db:	VULHUB	id:	VHN-86187
db:	BID	id:	80353
db:	JVNDB	id:	JVNDB-2015-006752
db:	CNNVD	id:	CNNVD-201601-133
db:	NVD	id:	CVE-2015-8226

LAST UPDATE DATE

2025-04-12T23:18:45.431000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2016-00311	date:	2016-01-19T00:00:00
db:	VULHUB	id:	VHN-86187	date:	2016-01-13T00:00:00
db:	BID	id:	80353	date:	2015-12-10T00:00:00
db:	JVNDB	id:	JVNDB-2015-006752	date:	2016-01-14T00:00:00
db:	CNNVD	id:	CNNVD-201601-133	date:	2016-01-15T00:00:00
db:	NVD	id:	CVE-2015-8226	date:	2025-04-12T10:46:40.837

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2016-00311	date:	2016-01-19T00:00:00
db:	VULHUB	id:	VHN-86187	date:	2016-01-08T00:00:00
db:	BID	id:	80353	date:	2015-12-10T00:00:00
db:	JVNDB	id:	JVNDB-2015-006752	date:	2016-01-14T00:00:00
db:	CNNVD	id:	CNNVD-201601-133	date:	2016-01-12T00:00:00
db:	NVD	id:	CVE-2015-8226	date:	2016-01-08T19:59:11.163