CVE-2019-2228

In array_find of array.c, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local information disclosure in the printer spooler with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-111210196

CVSS v3 5.5 MEDIUM
CVSS v2.0 4.9 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.9^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:L/Au:N/C:C/I:N/A:N

Exploitability : 3.9 / Impact : 6.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://lists.debian.org/debian-lts-announce/2019/12/msg00030.html
https://source.android.com/security/bulletin/2019-12-01	Vendor Advisory
https://usn.ubuntu.com/4340-1/
https://lists.debian.org/debian-lts-announce/2019/12/msg00030.html
https://source.android.com/security/bulletin/2019-12-01	Vendor Advisory
https://usn.ubuntu.com/4340-1/

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:google:android:8.0:::::::*
	cpe:2.3:o:google:android:8.1:::::::*
	cpe:2.3:o:google:android:9.0:::::::*
	cpe:2.3:o:google:android:10.0:::::::*

History

21 Nov 2024, 04:40

Type	Values Removed	Values Added
References	~~() https://lists.debian.org/debian-lts-announce/2019/12/msg00030.html -~~	() https://lists.debian.org/debian-lts-announce/2019/12/msg00030.html -
References	~~() https://source.android.com/security/bulletin/2019-12-01 - Vendor Advisory~~	() https://source.android.com/security/bulletin/2019-12-01 - Vendor Advisory
References	~~() https://usn.ubuntu.com/4340-1/ -~~	() https://usn.ubuntu.com/4340-1/ -

Information

Published : 2019-12-06 23:15

Updated : 2024-11-21 04:40

NVD link : CVE-2019-2228

Mitre link : CVE-2019-2228

CVE.ORG link : CVE-2019-2228

JSON object : View

Products Affected

google

android

CWE

CWE-125

Out-of-bounds Read

{"id": "CVE-2019-2228", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.9, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 6.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2019-12-06T23:15:12.677", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2019/12/msg00030.html", "source": "security@android.com"}, {"url": "https://source.android.com/security/bulletin/2019-12-01", "tags": ["Vendor Advisory"], "source": "security@android.com"}, {"url": "https://usn.ubuntu.com/4340-1/", "source": "security@android.com"}, {"url": "https://lists.debian.org/debian-lts-announce/2019/12/msg00030.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://source.android.com/security/bulletin/2019-12-01", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://usn.ubuntu.com/4340-1/", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "In array_find of array.c, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local information disclosure in the printer spooler with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-111210196"}, {"lang": "es", "value": "En la funci\u00f3n array_find del archivo array.c, se presenta una posible lectura fuera de l\u00edmites debido a una comprobaci\u00f3n de l\u00edmites incorrecta. Esto podr\u00eda conllevar a una divulgaci\u00f3n de informaci\u00f3n local en la cola de impresi\u00f3n sin ser necesarios privilegios de ejecuci\u00f3n adicionales. No es requerida una interacci\u00f3n del usuario para su explotaci\u00f3n. Producto: Android, Versiones: Android-8.0 Android-8.1 Android-9 Android-10, ID de Android: A-111210196"}], "lastModified": "2024-11-21T04:40:28.517", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B578E383-0D77-4AC7-9C81-3F0B8C18E033"}, {"criteria": "cpe:2.3:o:google:android:8.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B06BE74B-83F4-41A3-8AD3-2E6248F7B0B2"}, {"criteria": "cpe:2.3:o:google:android:9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8DFAAD08-36DA-4C95-8200-C29FE5B6B854"}, {"criteria": "cpe:2.3:o:google:android:10.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D558D965-FA70-4822-A770-419E73BA9ED3"}], "operator": "OR"}]}], "sourceIdentifier": "security@android.com"}