CVE-2019-2107

In ihevcd_parse_pps of ihevcd_parse_headers.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-130024844.

CVSS v3.0

8.8 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v2.0

9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C

EPSS

8.93% chance of exploitation in the next 30 days, 95th percentile

Published

2019-07-08

Updated

2024-08-04

Proof-of-concept exploits (3)

• http://seclists.org/fulldisclosure/2019/Jul/18
• CrackerCat/CVE-2019-21071★ · 2019-07-13
• infiniteLoopers/CVE-2019-21074★ · 2019-07-27

ExploitDB entries (2)

• https://www.exploit-db.com/exploits/47157
• https://www.exploit-db.com/exploits/47119

References

• CVE Record
• NVD entry

Related

• CVE-2019-1096
• CVE-2019-2215
• CVE-2020-0601
• CVE-2020-1020
• CVE-2020-11492
• CVE-2020-3187