The Samsung and HTC onTouchEvent method implementation for Android on the T-Mobile…
Priority LOW 35CWE-255Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- —
- Confidentiality · integrity · availability
- Complete · None · None
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA.
Summary
The Samsung and HTC onTouchEvent method implementation for Android on the T-Mobile myTouch 3G Slide, HTC Merge, Sprint EVO Shift 4G, HTC ChaCha, AT&T Status, HTC Desire Z, T-Mobile G2, T-Mobile myTouch 4G Slide, and Samsung Galaxy S stores touch coordinates in the dmesg buffer, which allows remote attackers to obtain sensitive information via a crafted application, as demonstrated by PIN numbers, telephone numbers, and text messages.
Why it matters now
EPSS 0.01759 78th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 9
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:att:status:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | AT&T |
| cpe:2.3:h:htc:chacha:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | HTC |
| cpe:2.3:h:htc:desire:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | HTC |
| cpe:2.3:h:htc:merge:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | HTC |
| cpe:2.3:h:samsung:galaxy_s:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Samsung |
| cpe:2.3:h:sprint:evo_shift_4g:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Sprint |
| cpe:2.3:h:t-mobile:g2:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | T-mobile |
| cpe:2.3:h:t-mobile:mytouch_3g_slide:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | T-mobile |
| cpe:2.3:h:t-mobile:mytouch_4g_slide:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | T-mobile |
- cpe:2.3:h:att:status:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·AT&T
- cpe:2.3:h:htc:chacha:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·HTC
- cpe:2.3:h:htc:desire:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·HTC
- cpe:2.3:h:htc:merge:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·HTC
- cpe:2.3:h:samsung:galaxy_s:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Samsung
- cpe:2.3:h:sprint:evo_shift_4g:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Sprint
- cpe:2.3:h:t-mobile:g2:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·T-mobile
- cpe:2.3:h:t-mobile:mytouch_3g_slide:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·T-mobile
- cpe:2.3:h:t-mobile:mytouch_4g_slide:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·T-mobile
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2012-2980
- 2026-10-03 Alias added: GHSA-r7q2-c254-fg5v
References
Sources
- CVE-2012-2980 · CVE Program
- CVE-2012-2980 · NVD
- FIRST EPSS
- GHSA-r7q2-c254-fg5v · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences