Google Android up to 9 libvpx out-of-bounds

Summaryinfo

A vulnerability described as problematic has been identified in Google Android up to 9. The impacted element is an unknown function of the component libvpx. Such manipulation leads to out-of-bounds. This vulnerability is referenced as CVE-2019-9232. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Google Android up to 9 (Smartphone Operating System). Affected by this issue is an unknown code block of the component libvpx. The manipulation with an unknown input leads to a out-of-bounds vulnerability. Using CWE to declare the problem leads to CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality. CVE summarizes:

In libvpx, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-122675483

The weakness was published 08/20/2019 as Android 10 Security Release Notes as confirmed security bulletin (Website). The advisory is available at source.android.com. This vulnerability is handled as CVE-2019-9232 since 02/28/2019. The attack may be launched remotely. No form of authentication is required for exploitation. The technical details are unknown and an exploit is not available.

The vulnerability scanner Nessus provides a plugin with the ID 236547 (Alibaba Cloud Linux 3 : 0048: libvpx (ALINUX3-SA-2022:0048)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 10 eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (236547). Similar entries are available at VDB-142416, VDB-142417, VDB-142418 and VDB-142419. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Smartphone Operating System

Vendor

• Google

Name

• Android

Version

• 1.0
• 1.1
• 1.5
• 1.6
• 2.0
• 2.0.1
• 2.1
• 2.2
• 2.2.1
• 2.2.2
• 2.2.3
• 2.3
• 2.3.1
• 2.3.2
• 2.3.3
• 2.3.4
• 2.3.5
• 2.3.6
• 2.3.7
• 3.0
• 3.1
• 3.2
• 3.2.1
• 3.2.2
• 3.2.3
• 3.2.4
• 3.2.5
• 3.2.6
• 4.0
• 4.0.1
• 4.0.2
• 4.0.3
• 4.0.4
• 4.1
• 4.1.1
• 4.1.2
• 4.2
• 4.2.1
• 4.2.2
• 4.3
• 4.3.1
• 4.4
• 4.4.1
• 4.4.2
• 4.4.3
• 4.4.4
• 5.0
• 5.0.1
• 5.0.2
• 5.1
• 5.1.1
• 6.0
• 6.0.1
• 7.0
• 7.1
• 7.1.1
• 7.1.2
• 8.0
• 8.1
• 9.0

License

• free

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion