CVE-2019-2044: High severity Google Android vulnerability
In MakeMP>G4VideoCodecSpecificData of APacketSource.cpp, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to remote code execution in the media server with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9 Android ID: A-123701862
Affected Software
Event History
Frequently Asked Questions
Which Android releases are identified as affected?
The affected releases listed are Android 7.0, 7.1.1, 7.1.2, 8.0, 8.1, and 9.
What does an attacker need to exploit this issue?
The attack can be conducted remotely with low attack complexity and requires no privileges. Exploitation does require user interaction.
What security impact could successful exploitation have?
Successful exploitation could result in remote code execution in the media server. The CVSS vector indicates high impact to confidentiality, integrity, and availability.
Does exploitation require the attacker to obtain additional execution privileges first?
No. The vulnerability description states that remote code execution in the media server is possible without additional execution privileges.