PT-2019-14094 · Google+2 · Android+2

Publicado 2019-11-14 · Atualizado 2020-08-24 · CVE-2019-15365

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Lava Z92 Android device with a build fingerprint of LAVA/Z92/Z92:8.1.0/O11019/1535088037:user/release-keys com.mediatek.wfo.impl app version 8.1.0

Description The issue concerns a pre-installed app on the Lava Z92 Android device that allows any co-located app to modify a system property without proper authorization. This is due to an exported interface in the com.mediatek.wfo.impl app.

Recommendations For the Lava Z92 Android device, consider restricting access to the com.mediatek.wfo.impl app until a patch is available. As a temporary workaround, avoid using the exported interface in the com.mediatek.wfo.impl app to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2019-15365

Produtos afetados

Android

Lava Z92

Com.Mediatek.Wfo.Impl

Referências · 2

• https://nvd.nist.gov/vuln/detail/CVE-2019-15365 · Nota de Segurança
• https://kryptowire.com/android-firmware-2019 · Nota