Vulnerabilities > Chainfire

DATE CVE VULNERABILITY TITLE RISK
2014-03-31 CVE-2013-6775 Permissions, Privileges, and Access Controls vulnerability in Chainfire Supersu 1.69
The Chainfire SuperSU package before 1.69 for Android allows attackers to gain privileges via the (1) backtick or (2) $() type of shell metacharacters in the -c option to /system/xbin/su.
network
low complexity
chainfire google CWE-264
critical
 10.0
10
2014-03-31 CVE-2013-6774 Untrusted search path vulnerability in the ChainsDD Superuser package 3.1.3 for Android 4.2.x and earlier, CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android 4.2.x and earlier, and Chainfire SuperSU package before 1.69 for Android 4.2.x and earlier allows attackers to load an arbitrary .jar file and gain privileges via a crafted BOOTCLASSPATH environment variable for a /system/xbin/su process.
network
low complexity
chainfire google androidsu koushik-dutta
critical
 10.0
10