CVE-2024-34636: 
NixOS vulnerability analysis and mitigation

Use of implicit intent for sensitive communication in Samsung Email prior to version 6.1.94.2 allows local attackers to get sensitive information. The vulnerability was discovered and reported on April 20, 2024, and was assigned CVE-2024-34636. The affected software is Samsung Email versions prior to 6.1.94.2 (Samsung Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N by NIST. Samsung Mobile assigned a slightly different score of 4.0 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The vulnerability stems from the improper use of implicit intents for sensitive communication (NVD).

The vulnerability allows local attackers to access sensitive information through the exploitation of implicit intents in the Samsung Email application. The confidentiality impact is rated as High according to NIST's assessment, while there are no direct impacts on integrity or availability (NVD).

Samsung has released version 6.1.94.2 of the Email application which includes a patch that adds proper configuration to address the vulnerability. Users are advised to update their Samsung Email application to this version or later (Samsung Advisory).