CVE-2018-16268

The SoundServer/FocusServer system services in Tizen allow an unprivileged process to perform media-related system actions, due to improper D-Bus security policy configurations. Such actions include playing an arbitrary sound file or DTMF tones. This affects Tizen before 5.0 M1, and Tizen-based firmwares including Samsung Galaxy Gear series before build RE2.

• CWE-269

• https://media.defcon.org/DEF%20CON%2026/DEF%20CON%2026%20presentations/Dongsung%20Kim%20and%20Hyoung%20Kee%20Choi%20-%20Updated/DEFCON-26-Dongsung-Kim-and-Hyoung-Kee-Choi-Your-Watch-Can-Watch-You-Updated.pdfThird Party Advisory
• https://review.tizen.org/git/?p=platform/core/multimedia/libmm-sound.git%3Ba=commit%3Bh=7fce6f2d6d480b3bd0e84a5ba3f72173a37e36db
• https://www.youtube.com/watch?v=3IdgBwbOT-g&feature=youtu.beThird Party Advisory
• https://media.defcon.org/DEF%20CON%2026/DEF%20CON%2026%20presentations/Dongsung%20Kim%20and%20Hyoung%20Kee%20Choi%20-%20Updated/DEFCON-26-Dongsung-Kim-and-Hyoung-Kee-Choi-Your-Watch-Can-Watch-You-Updated.pdfThird Party Advisory
• https://review.tizen.org/git/?p=platform/core/multimedia/libmm-sound.git%3Ba=commit%3Bh=7fce6f2d6d480b3bd0e84a5ba3f72173a37e36db
• https://www.youtube.com/watch?v=3IdgBwbOT-g&feature=youtu.beThird Party Advisory

Published

Jan 22, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-16262The pkgmgr system service in Tizen allows an unprivileged pr…8.8
• CVE-2018-16263The PulseAudio system service in Tizen allows an unprivilege…8.8
• CVE-2018-16264The BlueZ system service in Tizen allows an unprivileged pro…6.5
• CVE-2018-16265The bt/bt_core system service in Tizen allows an unprivilege…6.5
• CVE-2018-16266The Enlightenment system service in Tizen allows an unprivil…8.1
• CVE-2018-16267The system-popup system service in Tizen allows an unprivile…8.1
• CVE-2018-16269The wnoti system service in Samsung Galaxy Gear series allow…7.5
• CVE-2018-16270Samsung Galaxy Gear series before build RE2 includes the hci…7.5
• CVE-2018-16271The wemail_consumer_service (from the built-in application w…6.5
• CVE-2018-16272The wpa_supplicant system service in Samsung Galaxy Gear ser…9.8
• CVE-2018-16275OPSWAT MetaDefender before v4.11.2 allows CSV injection.
• CVE-2018-16276An issue was discovered in yurex_read in drivers/usb/misc/yu…7.8