CVE-2019-2196: SQL Injection

Published Nov 4, 2019

Updated

In Download Provider, there is possible SQL injection. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-135269143

Affected Software

5 affected components

Google Android=8.0

Google Android=8.1

Google Android=9.0

Google Android=10.0

Google Android

Event History

Nov 4, 2019

CVE Published

via Android·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityWeaknessAffected Software

Nov 13, 2019

CVE Published

via MITRE·05:43 PM

Data Sourced

via MITRE·05:43 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2019-2196?

CVE-2019-2196 is classified as a medium severity vulnerability that allows possible SQL injection leading to local information disclosure.

Which versions of Android are affected by CVE-2019-2196?

CVE-2019-2196 affects Android versions 8.0, 8.1, 9, and 10.

How do I fix CVE-2019-2196?

To fix CVE-2019-2196, update your device to the latest security patch provided by Google that addresses this vulnerability.

What can be exploited through CVE-2019-2196?

CVE-2019-2196 can be exploited to disclose local information from the device via SQL injection without requiring user interaction.

Are there any requirements for exploiting CVE-2019-2196?

No additional execution privileges or user interaction are needed to exploit CVE-2019-2196.