The SwiftKey language-pack update implementation on Samsung Galaxy S4, S4 Mini, S5, and S6 devices relies on an HTTP connection to the…

Description

The SwiftKey language-pack update implementation on Samsung Galaxy S4, S4 Mini, S5, and S6 devices relies on an HTTP connection to the skslm.swiftkey.net server, which allows man-in-the-middle attackers to write to language-pack files by modifying an HTTP response. NOTE: CVE-2015-4640 exploitation can be combined with CVE-2015-4641 exploitation for man-in-the-middle code execution.

Scores

EPSS (exploitation in 30 days)

0.95% · top 39% of all CVEs (3 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 2.9.

Weakness

• n/a
• CWE-254 (opens in a new tab)All about CWE-254 and its CVEs

Affected products

• n/a

  • affected n/a

References (6)

• https://www.nowsecure.com/keyboard-vulnerability/ (opens in a new tab)x_refsource_MISCx_transferred
• https://www.nowsecure.com/blog/2015/06/16/remote-code-execution-as-system-user-on-samsung-phones/ (opens in a new tab)x_refsource_MISCx_transferred
• https://github.com/nowsecure/samsung-ime-rce-poc/ (opens in a new tab)x_refsource_MISCx_transferred
• 75347 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
• http://arstechnica.com/security/2015/06/new-exploit-turns-samsung-galaxy-phones-into-remote-bugging-devices/ (opens in a new tab)x_refsource_MISCx_transferred
• VU#155412 (opens in a new tab)third-party-advisoryx_refsource_CERT-VNx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2015-4640](https://trackcve.app/badge/CVE-2015-4640.svg)](https://trackcve.app/cve/CVE-2015-4640)

Record last updated 6 Aug 2024, 06:18 UTC.