CVE-2019-10251: Medium severity ucweb uc browser vulnerability
The UCWeb UC Browser application through 2019-03-26 for Android uses HTTP to download certain modules associated with PDF and Microsoft Office files (related to libpicsel), which allows MITM attacks.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
An attacker does not need an account, user interaction, or local access. Exploitation requires a man-in-the-middle position on the network and relies on the browser downloading affected PDF or Microsoft Office-related modules over HTTP.
Which users are exposed?
Users of UCWeb UC Browser on Android are affected if they use a version through 2019-03-26 and the application downloads the relevant libpicsel-associated modules. The issue is network-exploitable but has high attack complexity.
What is the potential impact of a successful attack?
A successful man-in-the-middle attacker may compromise the confidentiality of affected users. The supplied CVSS vector indicates no integrity or availability impact.