CVE-2019-1997: High severity Google Android vulnerability

Published Feb 4, 2019

Updated

In randomgetbytes of random.c, there is a possible degradation of randomness due to an insecure default value. This could lead to local information disclosure via an insecure wireless connection with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-117508900.

Affected Software

7 affected components

Google Android=7.0

Google Android=7.1.1

Google Android=7.1.2

Google Android=8.0

Google Android=8.1

Google Android=9.0

Google Android

Event History

Feb 4, 2019

CVE Published

via Android·12:00 AM

Feb 28, 2019

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2019-1997?

CVE-2019-1997 has been classified as a moderate severity vulnerability due to potential local information disclosure risks.

How do I fix CVE-2019-1997?

To mitigate CVE-2019-1997, ensure that your device is updated to a secure version of Android that addresses this vulnerability.

What impact does CVE-2019-1997 have on users?

CVE-2019-1997 could lead to information disclosure over an insecure wireless connection without requiring additional execution privileges.

Which versions of Android are affected by CVE-2019-1997?

CVE-2019-1997 affects Android versions 7.0, 7.1.1, 7.1.2, 8.0, 8.1, and 9.0.

Is user interaction required for exploiting CVE-2019-1997?

No, user interaction is not needed for the exploitation of CVE-2019-1997.