CVE-2019-9232 In libvpx, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is no...
HighCVSS 7.5
EPSS 4.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In libvpx, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-122675483
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libvpx(Debian:12) | < 1.8.1-2 | 1.8.1-2 |
| debian/libvpx(Debian:13) | < 1.8.1-2 | 1.8.1-2 |
| debian/libvpx(Debian:14) | < 1.8.1-2 | 1.8.1-2 |
| Google Android | = 10.0 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| Canonical Ubuntu Linux | = 18.04 | No fix listed |
| Canonical Ubuntu Linux | = 19.04 | No fix listed |
| openSUSE leap | = 15.1 | No fix listed |
| fedoraproject fedora | = 30 | No fix listed |
| fedoraproject fedora | = 31 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| debian linux | = 10.0 | No fix listed |
| alpine/libvpx(Alpine:v3.11) | < 1.8.1-r0 | 1.8.1-r0 |
| alpine/libvpx(Alpine:v3.12) | < 1.8.1-r0 | 1.8.1-r0 |
| alpine/libvpx(Alpine:v3.13) | < 1.8.1-r0 | 1.8.1-r0 |
| alpine/libvpx(Alpine:v3.14) | < 1.8.1-r0 | 1.8.1-r0 |
| alpine/libvpx(Alpine:v3.15) | < 1.8.1-r0 | 1.8.1-r0 |
| alpine/libvpx(Alpine:v3.16) | < 1.8.1-r0 | 1.8.1-r0 |
| alpine/libvpx(Alpine:v3.17) | < 1.8.1-r0 | 1.8.1-r0 |
| alpine/libvpx(Alpine:v3.18) | < 1.8.1-r0 | 1.8.1-r0 |
| alpine/libvpx(Alpine:v3.19) | < 1.8.1-r0 | 1.8.1-r0 |
| alpine/libvpx(Alpine:v3.20) | < 1.8.1-r0 | 1.8.1-r0 |
| alpine/libvpx(Alpine:v3.21) | < 1.8.1-r0 | 1.8.1-r0 |
Show 3 more
| Product | Affected versions | Fixed in |
|---|---|---|
| alpine/libvpx(Alpine:v3.22) | < 1.8.1-r0 | 1.8.1-r0 |
| alpine/libvpx(Alpine:v3.23) | < 1.8.1-r0 | 1.8.1-r0 |
| alpine/libvpx(Alpine:v3.24) | < 1.8.1-r0 | 1.8.1-r0 |
References
- Debian Security Tracker CVE-2019-9232 vendor-advisory
- openSUSE-SU-2020:0105 mailing-list third-party-advisory vendor-advisory
- [oss-security] 20191025 Security fixes from Android 10 release which are relevant outside the Android ecosystem? mailing-list
- [oss-security] 20191026 Re: Security fixes from Android 10 release which are relevant outside the Android ecosystem? mailing-list
- [oss-security] 20191107 Re: Security fixes from Android 10 release which are relevant outside the Android ecosystem? mailing-list
- [debian-lts-announce] 20191126 [SECURITY] [DLA 2012-1] libvpx security update mailing-list third-party-advisory
- FEDORA-2020-6cd410d9e4 vendor-advisory
- FEDORA-2020-65eac1b48b vendor-advisory
- 20191128 [SECURITY] [DSA 4578-1] libvpx security update mailing-list third-party-advisory
- GLSA-202003-59 third-party-advisory vendor-advisory
- source.android.com vendor-advisory
- USN-4199-1 third-party-advisory vendor-advisory
- USN-4199-2 third-party-advisory vendor-advisory
- DSA-4578 third-party-advisory vendor-advisory
- security.alpinelinux.org vendor-advisory