Android Security Bulletin 2019-12: CVE-2019-2232/2222/15140 Details

Key Vulnerability Information Vulnerability Overview Release Date: December 2, 2019 Update Date: January 14, 2020 Main Content: The Android security bulletin includes details of security vulnerabilities affecting Android devices, including vulnerability descriptions, CVE numbers, affected components, vulnerability types, severity levels, and updated AOSP versions. Vulnerability Classification December 1, 2019 Security Patch Level Vulnerability Details - Framework - The most severe vulnerability could allow a remote attacker to cause permanent denial of service via a crafted message. - CVE-2019-2232: DoS type, severity level Critical, affects versions 8.0, 8.1, 9, 10. - Media Framework - The most severe vulnerability could allow a remote attacker to execute arbitrary code in privileged context via a crafted file. - CVE-2019-2222: RCE type, severity level Moderate, affects version 10. - System - The most severe vulnerability could allow a remote attacker to execute arbitrary code in non-privileged context via a crafted file. - CVE-2019-15140: RCE type, severity level High, affects versions 8.0, 8.1, 9, 10. Google Play System Updates - These security issues are included in Google Play system updates. Frequently Asked Questions 1. How can I determine if my device has been updated to address these issues? 2. Why does this bulletin have two security patch levels? 3. What do the entries in the Type column of the vulnerability details table mean? 4. What do the entries in the References column of the vulnerability details table mean? 5. Why are security vulnerabilities split between the bulletin and device/partner security bulletins, such as the Pixel bulletin? Update History 1.0: December 2, 2019 — Bulletin released. 1.1: December 3, 2019 — Bulletin revised to include AOSP links. 1.2: December 13, 2019 — CVE table revised. 1.3: January 14, 2020 — Patch ID A-140328986 updated to CVE-2019-15140.

Goal Reached Thanks to every supporter — we hit 100%!

Android Security Bulletin 2019-12: CVE-2019-2232/2222/15140 Details