CVEvulnerability
CVE-2019-9278
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2019-09-27
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-190, CWE-787
Description
In libexif, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of privilege in the media content provider with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-112537774
Affected configurations
• google android 10.0
• opensuse leap 15.1
• fedoraproject fedora 31
• fedoraproject fedora 32
• debian debian linux 8.0
• debian debian linux 9.0
• debian debian linux 10.0
• canonical ubuntu linux 12.04
• canonical ubuntu linux 14.04
• canonical ubuntu linux 16.04
• canonical ubuntu linux 18.04
• canonical ubuntu linux 19.10
Related
References
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00000.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00017.html Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2019/10/25/17 Mailing List
- http://www.openwall.com/lists/oss-security/2019/10/27/1 Mailing List
- http://www.openwall.com/lists/oss-security/2019/11/07/1 Mailing List
- https://github.com/libexif/libexif/commit/75aa73267fdb1e0ebfbc00369e7312bac43d0566 Patch, Third Party Advisory
- https://github.com/libexif/libexif/issues/26 Issue Tracking, Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/02/msg00007.html Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MO2VTHD7OLPJDCJBHKUQTBAHZOBBCF6X/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VA5BPQLOFXIZOOJHBYDU635Z5KLUMTDD/ lists.fedoraproject.org
- https://seclists.org/bugtraq/2020/Feb/9 Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202007-05 Third Party Advisory
- https://source.android.com/security/bulletin/android-10 Vendor Advisory
- https://usn.ubuntu.com/4277-1/ Third Party Advisory
- https://www.debian.org/security/2020/dsa-4618 Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00000.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00017.html Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2019/10/25/17 Mailing List
- http://www.openwall.com/lists/oss-security/2019/10/27/1 Mailing List
- http://www.openwall.com/lists/oss-security/2019/11/07/1 Mailing List
- https://github.com/libexif/libexif/commit/75aa73267fdb1e0ebfbc00369e7312bac43d0566 Patch, Third Party Advisory
- https://github.com/libexif/libexif/issues/26 Issue Tracking, Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/02/msg00007.html Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MO2VTHD7OLPJDCJBHKUQTBAHZOBBCF6X/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VA5BPQLOFXIZOOJHBYDU635Z5KLUMTDD/ lists.fedoraproject.org
- https://seclists.org/bugtraq/2020/Feb/9 Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202007-05 Third Party Advisory
- https://source.android.com/security/bulletin/android-10 Vendor Advisory
- https://usn.ubuntu.com/4277-1/ Third Party Advisory
- https://www.debian.org/security/2020/dsa-4618 Third Party Advisory