title: MTP service exposed during emergency dialer
description: Information Exposure vulnerability in Unity8 as used on the Ubuntu phone and possibly also in Unity8 shipped elsewhere. This allows an attacker to enable the MTP service by opening the emergency dialer. Fixed in 8.11+16.04.20160111.1-0ubuntu1 and 8.11+15.04.20160122-0ubuntu1.
problem types: CWE-200 Information Exposure
affected:
{
product: unity8 (Ubuntu)
vendor: Canonical
versions:
changes: [at: 8.11+15.04.20160122-0ubuntu1, status: unaffected], lessThan: 8.11+16.04.20160111.1-0ubuntu1, status: affected, version: 8.11, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: NONE
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
version: 3.1
]