CVE-2019-9278
Estado: ModificadaAlta (8.8)—
En libexif, se presenta una posible escritura fuera de límites debido a un desbordamiento de enteros. Esto podría conllevar a una escalada de privilegios remota en el proveedor de contenido multimedia sin ser necesarios privilegios de ejecución adicionales. Es requerida una interacción del usuario para su explotación. Producto: Android, Versiones: Android-10, ID de Android: A-112537774
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Puntuación base: 8.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 4.06%
- Percentil entre todas las CVEs puntuadas: 90
- Fecha de la puntuación: 8/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (5)
CWE
- CWE-190, CWE-787
Referencias
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00000.html
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00017.html
- http://www.openwall.com/lists/oss-security/2019/10/25/17
- http://www.openwall.com/lists/oss-security/2019/10/27/1
- http://www.openwall.com/lists/oss-security/2019/11/07/1
- https://github.com/libexif/libexif/commit/75aa73267fdb1e0ebfbc00369e7312bac43d0566
- https://github.com/libexif/libexif/issues/26
- https://lists.debian.org/debian-lts-announce/2020/02/msg00007.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MO2VTHD7OLPJDCJBHKUQTBAHZOBBCF6X/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VA5BPQLOFXIZOOJHBYDU635Z5KLUMTDD/
- https://seclists.org/bugtraq/2020/Feb/9
- https://security.gentoo.org/glsa/202007-05
- https://source.android.com/security/bulletin/android-10
- https://usn.ubuntu.com/4277-1/
- https://www.debian.org/security/2020/dsa-4618
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00000.html
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00017.html
- http://www.openwall.com/lists/oss-security/2019/10/25/17
- http://www.openwall.com/lists/oss-security/2019/10/27/1
- http://www.openwall.com/lists/oss-security/2019/11/07/1
- https://github.com/libexif/libexif/commit/75aa73267fdb1e0ebfbc00369e7312bac43d0566
- https://github.com/libexif/libexif/issues/26
- https://lists.debian.org/debian-lts-announce/2020/02/msg00007.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MO2VTHD7OLPJDCJBHKUQTBAHZOBBCF6X/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VA5BPQLOFXIZOOJHBYDU635Z5KLUMTDD/
- https://seclists.org/bugtraq/2020/Feb/9
- https://security.gentoo.org/glsa/202007-05
- https://source.android.com/security/bulletin/android-10
- https://usn.ubuntu.com/4277-1/
- https://www.debian.org/security/2020/dsa-4618
JSON original (NVD)
Mostrar
{
"id": "CVE-2019-9278",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 6.8,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "MEDIUM",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 6.4,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 8.8,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "security@android.com",
"affectedData": [
{
"vendor": "n/a",
"product": "Android",
"versions": [
{
"status": "affected",
"version": "Android-10"
}
]
}
]
}
],
"published": "2019-09-27T19:15:19.060",
"references": [
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00000.html",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "security@android.com"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00017.html",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "security@android.com"
},
{
"url": "http://www.openwall.com/lists/oss-security/2019/10/25/17",
"tags": [
"Mailing List"
],
"source": "security@android.com"
},
{
"url": "http://www.openwall.com/lists/oss-security/2019/10/27/1",
"tags": [
"Mailing List"
],
"source": "security@android.com"
},
{
"url": "http://www.openwall.com/lists/oss-security/2019/11/07/1",
"tags": [
"Mailing List"
],
"source": "security@android.com"
},
{
"url": "https://github.com/libexif/libexif/commit/75aa73267fdb1e0ebfbc00369e7312bac43d0566",
"tags": [
"Patch",
"Third Party Advisory"
],
"source": "security@android.com"
},
{
"url": "https://github.com/libexif/libexif/issues/26",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"source": "security@android.com"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00007.html",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "security@android.com"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MO2VTHD7OLPJDCJBHKUQTBAHZOBBCF6X/",
"source": "security@android.com"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VA5BPQLOFXIZOOJHBYDU635Z5KLUMTDD/",
"source": "security@android.com"
},
{
"url": "https://seclists.org/bugtraq/2020/Feb/9",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "security@android.com"
},
{
"url": "https://security.gentoo.org/glsa/202007-05",
"tags": [
"Third Party Advisory"
],
"source": "security@android.com"
},
{
"url": "https://source.android.com/security/bulletin/android-10",
"tags": [
"Vendor Advisory"
],
"source": "security@android.com"
},
{
"url": "https://usn.ubuntu.com/4277-1/",
"tags": [
"Third Party Advisory"
],
"source": "security@android.com"
},
{
"url": "https://www.debian.org/security/2020/dsa-4618",
"tags": [
"Third Party Advisory"
],
"source": "security@android.com"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00000.html",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00017.html",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.openwall.com/lists/oss-security/2019/10/25/17",
"tags": [
"Mailing List"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.openwall.com/lists/oss-security/2019/10/27/1",
"tags": [
"Mailing List"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.openwall.com/lists/oss-security/2019/11/07/1",
"tags": [
"Mailing List"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://github.com/libexif/libexif/commit/75aa73267fdb1e0ebfbc00369e7312bac43d0566",
"tags": [
"Patch",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://github.com/libexif/libexif/issues/26",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00007.html",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MO2VTHD7OLPJDCJBHKUQTBAHZOBBCF6X/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VA5BPQLOFXIZOOJHBYDU635Z5KLUMTDD/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://seclists.org/bugtraq/2020/Feb/9",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://security.gentoo.org/glsa/202007-05",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://source.android.com/security/bulletin/android-10",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://usn.ubuntu.com/4277-1/",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.debian.org/security/2020/dsa-4618",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-190"
},
{
"lang": "en",
"value": "CWE-787"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In libexif, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of privilege in the media content provider with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-112537774"
},
{
"lang": "es",
"value": "En libexif, se presenta una posible escritura fuera de límites debido a un desbordamiento de enteros. Esto podría conllevar a una escalada de privilegios remota en el proveedor de contenido multimedia sin ser necesarios privilegios de ejecución adicionales. Es requerida una interacción del usuario para su explotación. Producto: Android, Versiones: Android-10, ID de Android: A-112537774"
}
],
"lastModified": "2026-06-17T02:43:28.730",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:google:android:10.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D558D965-FA70-4822-A770-419E73BA9ED3"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B620311B-34A3-48A6-82DF-6F078D7A4493"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "80F0FA5D-8D3B-4C0E-81E2-87998286AF33"
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "36D96259-24BD-44E2-96D9-78CE1D41F956"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252"
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1F3EFED2-F6BC-46D9-AB22-D5ED87EF4549"
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*",
"vulnerable": true,
"matchCriteriaId": "815D70A8-47D3-459C-A32C-9FEACA0659D1"
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7A5301BF-1402-4BE0-A0F8-69FBE79BC6D6"
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
"vulnerable": true,
"matchCriteriaId": "23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D"
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A31C8344-3E02-4EB8-8BD8-4C84B7959624"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "security@android.com"
}