PT-2019-17560 · Huawei · P30

Publicado 2019-11-13 · Atualizado 2019-11-18 · CVE-2019-5288

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions P30 smart phones versions earlier than ELLE-AL00B 9.1.0.193(C00E190R2P1)

Description The issue is caused by an integer overflow due to insufficient checks on specific parameters. An attacker can exploit this by tricking a user into installing a malicious application, obtaining root permission, and constructing specific parameters to the camera program. This could cause the program to crash or allow for arbitrary code execution.

Recommendations For versions earlier than ELLE-AL00B 9.1.0.193(C00E190R2P1), update to a version equal to or later than ELLE-AL00B 9.1.0.193(C00E190R2P1) to resolve the issue. As a temporary workaround, consider restricting the installation of applications from untrusted sources and avoiding the use of the camera program with unverified parameters until a patch is available.

Correção

Integer Overflow

Enumeração de Fraquezas

CWE-190

Identificadores relacionados

CVE-2019-5288

Produtos afetados

P30

Referências · 3

• http://huawei.com/en/psirt/security-advisories/huawei-sa-20190925-01-smartphone-en · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-5288 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-5288 · Nota de Segurança