CVE-2019-2130

EUVD-2019-11772
In CompilationJob::FinalizeJob of compiler.cc, there is a possible remote code execution due to type confusion. This could lead to escalation of privilege from a malicious proxy configuration with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-132073833.
Type Confusion
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 77%
Affected Products (NVD)
VendorProductVersion
googleandroid
7.0
googleandroid
7.1.1
googleandroid
7.1.2
googleandroid
8.0
googleandroid
8.1
googleandroid
9.0
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
chromium-browser
bionic
not-affected
disco
ignored
eoan
not-affected
trusty
dne
xenial
not-affected
qtwebengine-opensource-src
bionic
not-affected
disco
ignored
eoan
not-affected
trusty
dne
xenial
dne
Common Weakness Enumeration
References
https://source.android.com/security/bulletin/2019-08-01
https://source.android.com/security/bulletin/2019-08-01