CVE-2018-19860: Input Validation

Reference Links

• https://source.android.com/docs/security/bulletin/2019-05-01/#asterisk
• https://source.android.com/docs/security/bulletin/2019-05-01 (Advisory)
• https://support.apple.com/en-us/HT210348 (Advisory)
• http://seclists.org/fulldisclosure/2019/Aug/11
• http://seclists.org/fulldisclosure/2019/Jul/22
• https://seclists.org/bugtraq/2019/Aug/21
• https://source.android.com/security/bulletin/2019-05-01
• https://support.apple.com/kb/HT210348
• https://www.broadcom.com/support/resources/product-security-center

Parent vulnerabilities

(Appears in the following advisories)

• HT210348

Peer vulnerabilities

(Found alongside the following vulnerabilities)

• CVE-2019-8693
• CVE-2019-8656
• CVE-2018-19860
• CVE-2019-9506
• CVE-2020-10135
• CVE-2019-8661
• CVE-2019-8646
• CVE-2019-8660
• CVE-2019-8675
• CVE-2019-8696
• CVE-2019-8539
• CVE-2019-8697
• CVE-2019-8648
• CVE-2019-8663
• CVE-2019-8702
• CVE-2019-8695
• CVE-2019-8691
• CVE-2019-8692
• CVE-2018-16860
• CVE-2019-8694
• CVE-2019-13118
• CVE-2019-8662
• CVE-2019-8670
• CVE-2019-8701
• CVE-2019-8667
• CVE-2019-8657
• CVE-2019-8690
• CVE-2019-8649
• CVE-2019-8658
• CVE-2019-8644
• CVE-2019-8666
• CVE-2019-8669
• CVE-2019-8671
• CVE-2019-8672
• CVE-2019-8673
• CVE-2019-8676
• CVE-2019-8677
• CVE-2019-8678
• CVE-2019-8679
• CVE-2019-8680
• CVE-2019-8681
• CVE-2019-8683
• CVE-2019-8684
• CVE-2019-8685
• CVE-2019-8686
• CVE-2019-8687
• CVE-2019-8688
• CVE-2019-8689

Frequently Asked Questions

• What is the severity of CVE-2018-19860?

  CVE-2018-19860 has a high severity rating due to its potential to allow remote code execution via Bluetooth.

• How do I fix CVE-2018-19860?

  To fix CVE-2018-19860, update the affected Broadcom firmware versions to the latest that address this vulnerability.

• Which devices are affected by CVE-2018-19860?

  CVE-2018-19860 affects certain Broadcom firmware used in devices like the Nexus 5 and Raspberry Pi 3 among others.

• What kind of issue is CVE-2018-19860 classified as?

  CVE-2018-19860 is classified as a memory corruption issue resulting from improper input validation in Bluetooth.

• When was CVE-2018-19860 disclosed?

  CVE-2018-19860 was disclosed in May 2019 as part of the Android security bulletin.