LiveActive security incident?Get immediate response
CVE Record

CVE-2015-9547: An issue was discovered on Samsung mobile devices with JBP(4.3) and KK(4.4.2) software.

An issue was discovered on Samsung mobile devices with JBP(4.3) and KK(4.4.2) software. Because the READ_LOGS permission is mishandled, sensitive information is disclosed in a world-readable copy of the log file if the error message is "Unhandled exception in Dalvik VM," "Application not responding ANR event," or "Crash on an application's native code." The Samsung ID is SVE-2015-2885 (October 2015).

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This CVE describes sensitive information exposure on older Samsung mobile software. Some crash or ANR log copies may become world-readable because READ_LOGS handling is flawed. The source does not provide severity, CVSS, affected model names, or confirmed exploitation.

Executive priority

Treat this as a legacy-device hygiene issue unless matching Samsung devices remain in use. Business urgency rises if old mobile devices handle sensitive data or regulated workloads.

Technical view

On Samsung mobile devices with JBP 4.3 and KK 4.4.2 software, certain Dalvik VM, ANR, or native-code crash conditions can create world-readable log copies. The issue is tracked by Samsung as SVE-2015-2885 in October 2015.

Likely exposure

Exposure appears limited to legacy Samsung mobile devices running JBP 4.3 or KK 4.4.2. The provided sources do not identify specific models, builds, or CPEs.

Exploitation context

No KEV listing or cited source indicates active exploitation. The source bundle only supports a local information-disclosure risk from world-readable crash-related logs on affected software.

Researcher notes

Evidence is sparse: no CVSS, CWE, model list, patch detail, or exploit confirmation is provided. Analysis should stay bounded to Samsung mobile JBP 4.3 and KK 4.4.2 software and SVE-2015-2885.

Mitigation direction

  • Check Samsung guidance for SVE-2015-2885 and applicable October 2015 updates.
  • Retire or isolate Samsung devices still running JBP 4.3 or KK 4.4.2.
  • Avoid sensitive workflows on matching legacy devices until vendor status is confirmed.
  • Document any unsupported devices as accepted risk or remove them from service.

Validation and detection

  • Inventory Samsung mobile devices and record software versions.
  • Identify devices running JBP 4.3 or KK 4.4.2.
  • Compare matching devices against Samsung SVE-2015-2885 guidance.
  • Review whether sensitive apps or data are used on matching devices.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2015-9547 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.