CVE-2019-2109: Critical severity Google Android vulnerability

Published Jul 1, 2019

Updated

In MakeMPEG4VideoCodecSpecificData of AVIExtractor.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1. Android ID: A-130651570.

Affected Software

6 affected components

Google Android=7.0

Google Android=7.1.1

Google Android=7.1.2

Google Android=8.0

Google Android=8.1

Google Android

Event History

Jul 1, 2019

CVE Published

via Android·12:00 AM

Jul 8, 2019

CVE Published

via MITRE·05:36 PM

Data Sourced

via MITRE·05:36 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2019-2109?

CVE-2019-2109 is considered a critical vulnerability due to its potential to allow remote code execution.

How do I fix CVE-2019-2109?

To resolve CVE-2019-2109, users should update their Android devices to the latest available version that addresses this vulnerability.

What versions of Android are affected by CVE-2019-2109?

CVE-2019-2109 affects Android versions 7.0, 7.1.1, 7.1.2, 8.0, and 8.1.

What type of exploitation is possible with CVE-2019-2109?

Exploitation of CVE-2019-2109 could allow an attacker to execute arbitrary code on the affected device.

Is user interaction required for CVE-2019-2109 exploitation?

Yes, user interaction is needed for the exploitation of CVE-2019-2109.