PT-2019-17559 · Huawei · P30

Published 2019-11-13 · Updated 2019-11-18 · CVE-2019-5287

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions P30 smart phones versions earlier than ELLE-AL00B 9.1.0.193(C00E190R2P1)

Description The issue is caused by an integer overflow due to insufficient checks on specific parameters. An attacker can trick a user into installing a malicious application, obtain root permission, and then construct specific parameters to the camera program to exploit this issue. Successful exploitation could cause the program to crash or allow for arbitrary code execution.

Recommendations For versions earlier than ELLE-AL00B 9.1.0.193(C00E190R2P1), update to version ELLE-AL00B 9.1.0.193(C00E190R2P1) or later to resolve the issue. As a temporary workaround, consider restricting the installation of applications from untrusted sources and avoiding the use of the camera program with unverified parameters until a patch is available.

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2019-5287

Affected Products

P30

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2019-5287 · Security Note
• http://huawei.com/en/psirt/security-advisories/huawei-sa-20190925-01-smartphone-en · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-5287 · Vendor Advisory