Security Advisory - Two Insufficient Input Validation Vulnerabilities in Huawei Smart Phones

Some Huawei phones have two insufficient input validation vulnerabilities due to lack of parameter check. An attacker tricks the user who has root privilege to install a crafted application, the application may modify different specific data to exploit these two vulnerabilities. Successful exploit could allow the attacker to execute arbitrary code. (Vulnerability ID: HWPSIRT-2018-07005 and HWPSIRT-2018-07006)

The two vulnerabilities have been assigned two Common Vulnerabilities and Exposures (CVE) IDs: CVE-2018-7922 and CVE-2018-7923.

Huawei has released software updates to fix these vulnerabilities. This advisory is available at the following link:

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180911-01-smartphone-en