Google released security updates for Android that deploy fixes for 15 vulnerabilities with severity level critical, high and moderate and another 22 vulnerabilities patched Qualcomm components.
The source code for the issues to be released with the Android Open Source Project (AOSP) repository and Google said that “partners notified about the issue before a month.”
Among them, the most severe one is the security vulnerability with the Android framework component. The vulnerability can be tracked CVE-2019-2232, it allows a remote attacker to cause a permanent denial of service which may result in bricking of the phone.
The vulnerability can be exploited by a remote attacker using a specially crafted message without any user interaction. Improper input validation in handleRun of TextLine.java with the component Unicode Handler leads to denial of service with no user privileges.
Technical details of the vulnerability were not disclosed, Android versions affected: 8.0/8.1/9.0/10.0.
The vulnerability is classified as critical and it affects ihevcd_parse_slice_data of ihevcd_parse_slice.c function. It writes outside the bounds of allocated memory due to missing bounds check.
It may result in remote code execution and to exploit the vulnerability user interaction is required. Android versions affected: 8.0/8.1/9.0/10.0.
It affects ihevcd_ref_list of ihevcd_ref_list.c, another out of bounds write vulnerability due to missing bounds check. It allows an attacker to execute code remotely without any additional privileges. Android versions affected: 8.0/8.1/9.0/10.0.
The update for the patches depends upon the Android device manufacturer. The good news is that there are no current reports of these vulnerabilities exploited.
Samsung said that it is ” is releasing a maintenance release for major flagship models as part of the monthly Security Maintenance Release (SMR) process. This SMR package includes patches from Google and Samsung.”
LG has rolled out patches for December 2019 security bulletin, covering three critical security vulnerabilities.
Google said that “Google devices start receiving OTA updates on the same day the monthly bulletin is released. In general, it takes about one and a half calendar weeks for the OTA to reach every Google device.”
You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.
Penetration testing companies play a vital role in strengthening the cybersecurity defenses of organizations by…
Cybersecurity researchers continue to track sophisticated "Click Fix" style distribution campaigns that deliver the notorious…
In a novel and concerning development, multiple U.S. organizations have reported receiving suspicious physical letters…
The cybersecurity landscape has recently been impacted by the emergence of the Strela Stealer malware,…
A recent discovery by the Socket Research Team has unveiled a malicious PyPI package named…
A recent cybersecurity threat has emerged where unknown attackers are exploiting a critical remote code…