{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "09E6085C-A61E-4A89-BF80-EDD9A7DF1E47",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "D835D592-2423-44C6-804A-3AD010112E7C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "568E2561-A068-46A2-B331-BBA91FC96F0C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "B578E383-0D77-4AC7-9C81-3F0B8C18E033",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:google:android:8.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "B06BE74B-83F4-41A3-8AD3-2E6248F7B0B2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In MakeMPEG4VideoCodecSpecificData of AVIExtractor.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1. Android ID: A-130651570."
    },
    {
      "lang": "es",
      "value": "En la funci\u00f3n MakeMPEG4VideoCodecSpecificData del archivo AVIExtractor.cpp, se presenta una posible escritura fuera de l\u00edmites debido a una comprobaci\u00f3n de l\u00edmites incorrecta. Esto podr\u00eda conllevar a la ejecuci\u00f3n de c\u00f3digo remota sin ser necesarios privilegios de ejecuci\u00f3n adicionales. La interacci\u00f3n del usuario es necesaria para su explotaci\u00f3n. Producto: Android. Versiones: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1. ID de Android: A-130651570."
    }
  ],
  "id": "CVE-2019-2109",
  "lastModified": "2024-11-21T04:40:14.823",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 9.3,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2019-07-08T18:15:11.370",
  "references": [
    {
      "source": "security@android.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://source.android.com/security/bulletin/2019-07-01"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://source.android.com/security/bulletin/2019-07-01"
    }
  ],
  "sourceIdentifier": "security@android.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}