Google Android up to 9 libxaac out-of-bounds

Summaryinfo

A vulnerability was found in Google Android up to 9. It has been rated as problematic. Affected is an unknown function of the component libxaac. This manipulation causes out-of-bounds. This vulnerability is handled as CVE-2019-2163. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as problematic was found in Google Android up to 9 (Smartphone Operating System). Affected by this vulnerability is an unknown function of the component libxaac. The manipulation with an unknown input leads to a out-of-bounds vulnerability. The CWE definition for the vulnerability is CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality. The summary by CVE is:

In libxaac there is a possible out of bounds read due to a missing bounds check. This could lead to information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-118138797

The weakness was released 08/20/2019 as Android 10 Security Release Notes as confirmed security bulletin (Website). It is possible to read the advisory at source.android.com. This vulnerability is known as CVE-2019-2163 since 12/10/2018. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 10 eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.

Entries connected to this vulnerability are available at VDB-142416, VDB-142417, VDB-142418 and VDB-142419. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Smartphone Operating System

Vendor

• Google

Name

• Android

Version

• 1.0
• 1.1
• 1.5
• 1.6
• 2.0
• 2.0.1
• 2.1
• 2.2
• 2.2.1
• 2.2.2
• 2.2.3
• 2.3
• 2.3.1
• 2.3.2
• 2.3.3
• 2.3.4
• 2.3.5
• 2.3.6
• 2.3.7
• 3.0
• 3.1
• 3.2
• 3.2.1
• 3.2.2
• 3.2.3
• 3.2.4
• 3.2.5
• 3.2.6
• 4.0
• 4.0.1
• 4.0.2
• 4.0.3
• 4.0.4
• 4.1
• 4.1.1
• 4.1.2
• 4.2
• 4.2.1
• 4.2.2
• 4.3
• 4.3.1
• 4.4
• 4.4.1
• 4.4.2
• 4.4.3
• 4.4.4
• 5.0
• 5.0.1
• 5.0.2
• 5.1
• 5.1.1
• 6.0
• 6.0.1
• 7.0
• 7.1
• 7.1.1
• 7.1.2
• 8.0
• 8.1
• 9.0

License

• free

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion