CVE-2020-6616

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Some Broadcom chips mishandle Bluetooth random-number generation because a low-entropy Pseudo Random Number Generator (PRNG) is used in situations where a Hardware Random Number Generator (HRNG) should have been used to prevent spoofing. This affects, for example, Samsung Galaxy S8, S8+, and Note8 devices with the BCM4361 chipset. The Samsung ID is SVE-2020-16882 (May 2020).

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected software

No affected versions have been published.

Timeline

Published: May 8, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-66178.8stb stb_truetype.h through 1.22 has an assertion failure in stbtt__cff_int.CVE-2020-66188.8stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__find_table.CVE-2020-66198.8stb stb_truetype.h through 1.22 has an assertion failure in stbtt__buf_seek.CVE-2020-66208.8stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__buf_get8.CVE-2020-66218.8stb stb_truetype.h through 1.22 has a heap-based buffer over-read in ttUSHORT.CVE-2020-66228.8stb stb_truetype.h through 1.22 has a heap-based buffer over-read in stbtt__buf_peek8.CVE-2020-66238.8stb stb_truetype.h through 1.22 has an assertion failure in stbtt__cff_get_index.CVE-2020-66247.1jhead through 3.04 has a heap-based buffer over-read in process_DQT in jpgqguess.c.CVE-2020-66257.1jhead through 3.04 has a heap-based buffer over-read in Get32s when called from ProcessGpsInfo in gpsinfo.c.CVE-2020-66279.8The web-management application on Seagate Central NAS STCG2000300, STCG3000300, and STCG4000300 devices allows OS command injection via mv_b CVE-2020-66288.8Ming (aka libming) 0.4.8 has a heap-based buffer over-read in the function decompile_SWITCH() in decompile.c.CVE-2020-66296.5Ming (aka libming) 0.4.8 has z NULL pointer dereference in the function decompileGETURL2() in decompile.c.