CVE-2019-9278

high-risk
Published 2019-09-27

In libexif, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of privilege in the media content provider with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-112537774

Do I need to act?

~
3.7% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.8/10 High
NETWORK / LOW complexity

Affected Products (12)

Affected Vendors

Debian Google Canonical Fedoraproject Opensuse

References (30)

Mailing List http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00000.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00017.html
Mailing List http://www.openwall.com/lists/oss-security/2019/10/25/17
Mailing List http://www.openwall.com/lists/oss-security/2019/10/27/1
Mailing List http://www.openwall.com/lists/oss-security/2019/11/07/1
Patch https://github.com/libexif/libexif/commit/75aa73267fdb1e0ebfbc00369e7312bac43d05...
Issue Tracking https://github.com/libexif/libexif/issues/26
Mailing List https://lists.debian.org/debian-lts-announce/2020/02/msg00007.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
Mailing List https://seclists.org/bugtraq/2020/Feb/9
Third Party Advisory https://security.gentoo.org/glsa/202007-05
Vendor Advisory https://source.android.com/security/bulletin/android-10
Third Party Advisory https://usn.ubuntu.com/4277-1/
Third Party Advisory https://www.debian.org/security/2020/dsa-4618
Mailing List http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00000.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00017.html
Mailing List http://www.openwall.com/lists/oss-security/2019/10/25/17
Mailing List http://www.openwall.com/lists/oss-security/2019/10/27/1
Mailing List http://www.openwall.com/lists/oss-security/2019/11/07/1
and 10 more references
54
/ 100
high-risk
Severity 30/34 · Critical
Exploitability 7/34 · Low
Exposure 17/34 · Moderate