Saturday, April 12, 2025
HomeAndroidCritical Android Security Vulnerability Let Remote Attacker Cause Permanent Denial of Service

Critical Android Security Vulnerability Let Remote Attacker Cause Permanent Denial of Service

Published on

SIEM as a Service

Follow Us on Google News

Google released security updates for Android that deploy fixes for 15 vulnerabilities with severity level critical, high and moderate and another 22 vulnerabilities patched Qualcomm components.

The source code for the issues to be released with the Android Open Source Project (AOSP) repository and Google said that “partners notified about the issue before a month.”

Security Vulnerabilities

CVE-2019-2232

Among them, the most severe one is the security vulnerability with the Android framework component. The vulnerability can be tracked CVE-2019-2232, it allows a remote attacker to cause a permanent denial of service which may result in bricking of the phone.

- Advertisement - Google News

The vulnerability can be exploited by a remote attacker using a specially crafted message without any user interaction. Improper input validation in handleRun of TextLine.java with the component Unicode Handler leads to denial of service with no user privileges.

Technical details of the vulnerability were not disclosed, Android versions affected: 8.0/8.1/9.0/10.0.

CVE-2019-2222

The vulnerability is classified as critical and it affects ihevcd_parse_slice_data of ihevcd_parse_slice.c function. It writes outside the bounds of allocated memory due to missing bounds check.

It may result in remote code execution and to exploit the vulnerability user interaction is required. Android versions affected: 8.0/8.1/9.0/10.0.

CVE-2019-2223

It affects ihevcd_ref_list of ihevcd_ref_list.c, another out of bounds write vulnerability due to missing bounds check. It allows an attacker to execute code remotely without any additional privileges. Android versions affected: 8.0/8.1/9.0/10.0.

Vulnerability Mitigation

The update for the patches depends upon the Android device manufacturer. The good news is that there are no current reports of these vulnerabilities exploited.

Samsung said that it is ” is releasing a maintenance release for major flagship models as part of the monthly Security Maintenance Release (SMR) process. This SMR package includes patches from Google and Samsung.”

LG has rolled out patches for December 2019 security bulletin, covering three critical security vulnerabilities.

Google said that “Google devices start receiving OTA updates on the same day the monthly bulletin is released. In general, it takes about one and a half calendar weeks for the OTA to reach every Google device.”

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Threat Actors Manipulate Search Results to Lure Users to Malicious Websites

Cybercriminals are increasingly exploiting search engine optimization (SEO) techniques and paid advertisements to manipulate...

Hackers Imitate Google Chrome Install Page on Google Play to Distribute Android Malware

Cybersecurity experts have unearthed an intricate cyber campaign that leverages deceptive websites posing as...

Dangling DNS Attack Allows Hackers to Take Over Organization’s Subdomain

Hackers are exploiting what's known as "Dangling DNS" records to take over corporate subdomains,...

HelloKitty Ransomware Returns, Launching Attacks on Windows, Linux, and ESXi Environments

Security researchers and cybersecurity experts have recently uncovered new variants of the notorious HelloKitty...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Threat Actors Manipulate Search Results to Lure Users to Malicious Websites

Cybercriminals are increasingly exploiting search engine optimization (SEO) techniques and paid advertisements to manipulate...

Hackers Imitate Google Chrome Install Page on Google Play to Distribute Android Malware

Cybersecurity experts have unearthed an intricate cyber campaign that leverages deceptive websites posing as...

Dangling DNS Attack Allows Hackers to Take Over Organization’s Subdomain

Hackers are exploiting what's known as "Dangling DNS" records to take over corporate subdomains,...