Vulnerability CVE-2019-2228

Vulnerability Name:

CVE-2019-2228 (CCN-172796)

Assigned:

2018-12-10

Published:

2019-12-03

Updated:

2019-12-23

Summary:

In array_find of array.c, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local information disclosure in the printer spooler with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-111210196

CVSS v3 Severity:

5.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
4.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): None Availibility (A): None

6.2 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
5.4 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): None Availibility (A): None

CVSS v2 Severity:

4.9 Medium (CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:N/A:N)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): None Availibility (A): None

4.9 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:N/A:N)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): None Availibility (A): None

Vulnerability Type:

CWE-125

Vulnerability Consequences:

Obtain Information

References:

Source: CCN
Type: Google Web site
Android

Source: MITRE
Type: CNA
CVE-2019-2228

Source: XF
Type: UNKNOWN
android-cve20192228-info-disc(172796)

Source: MLIST
Type: UNKNOWN
[debian-lts-announce] 20191222 [SECURITY] [DLA 2047-1] cups security update

Source: CCN
Type: Android Open Source Project
Android Security Bulletin December 2019

Source: MISC
Type: Vendor Advisory
https://source.android.com/security/bulletin/2019-12-01

Source: UBUNTU
Type: UNKNOWN
USN-4340-1

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2019-2228

Vulnerable Configuration:

Configuration 1:

cpe:/o:google:android:8.0:*:*:*:*:*:*:*

OR cpe:/o:google:android:8.1:*:*:*:*:*:*:*

OR cpe:/o:google:android:9.0:*:*:*:*:*:*:*

OR cpe:/o:google:android:10.0:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/o:google:android:-:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:112129	P	cups-2.3.3op2-4.2 on GA media (Moderate)	2022-01-17
oval:org.opensuse.security:def:105665	P	Security update for samba (Important)	2021-11-16
oval:com.ubuntu.disco:def:201922280000000	V	CVE-2019-2228 on Ubuntu 19.04 (disco) - low.	2019-12-06
oval:com.ubuntu.bionic:def:201922280000000	V	CVE-2019-2228 on Ubuntu 18.04 LTS (bionic) - low.	2019-12-06
oval:com.ubuntu.xenial:def:201922280000000	V	CVE-2019-2228 on Ubuntu 16.04 LTS (xenial) - low.	2019-12-06

BACK