CVE-2015-8546

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered on Samsung mobile devices with software through 2015-11-12, affecting the Galaxy S6/S6 Edge, Galaxy S6 Edge+, and Galaxy Note5 with the Shannon333 chipset. There is a stack-based buffer overflow in the baseband process that is exploitable for remote code execution via a fake base station. The Samsung ID is SVE-2015-5123 (December 2015).

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://security.samsungmobile.com/securityUpdate.smsbVendor Advisory
https://security.samsungmobile.com/securityUpdate.smsbVendor Advisory

Timeline

Published: Apr 10, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-85477.5The CoreUserInputHandler::doMode function in core/coreuserinputhandler.cpp in Quassel 0.10.0 allows remote attackers to cause a denial of se CVE-2015-854810.0Multiple unspecified vulnerabilities in Google V8 before 4.7.80.23, as used in Google Chrome before 47.0.2526.80, allow attackers to cause a CVE-2015-85497.1XML external entity (XXE) vulnerability in PyAMF before 0.8.0 allows remote attackers to cause a denial of service or read arbitrary files v CVE-2015-85508.2Xen, when used on a system providing PV backends, allows local guest OS administrators to cause a denial of service (host OS crash) or gain CVE-2015-85516.0The PCI backend driver in Xen, when running on an x86 system and using Linux 3.1.x through 4.3.x as the driver domain, allows local guest ad CVE-2015-85524.4The PCI backend driver in Xen, when running on an x86 system and using Linux 3.1.x through 4.3.x as the driver domain, allows local guest ad CVE-2015-85536.5Xen allows guest OS users to obtain sensitive information from uninitialized locations in host OS kernel memory by not enabling memory and I CVE-2015-85547.5Buffer overflow in hw/pt-msi.c in Xen 4.6.x and earlier, when using the qemu-xen-traditional (aka qemu-dm) device model, allows local x86 HV CVE-2015-85558.6Xen 4.6.x, 4.5.x, 4.4.x, 4.3.x, and earlier do not initialize x86 FPU stack and XMM registers when XSAVE/XRSTOR are not used to manage guest CVE-2015-855610.0Local privilege escalation vulnerability in the Gentoo QEMU package before 2.5.0-r1.CVE-2015-85579.0The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrar CVE-2015-85585.5The ehci_process_itd function in hw/usb/hcd-ehci.c in QEMU allows local guest OS administrators to cause a denial of service (infinite loop