PT-2020-11489 · Google · Android

Published 2020-06-11 · Updated 2021-07-21 · CVE-2020-0128

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Android versions Android-10

Description In the addPacket function of AMPEG4ElementaryAssembler, there is an out of bounds read due to an integer overflow. This could lead to remote information disclosure with no additional execution privileges required. User interaction is not needed for exploitation.

Recommendations For Android version Android-10, consider restricting access to the addPacket function of AMPEG4ElementaryAssembler to minimize the risk of exploitation until a patch is available.

Fix

Integer Overflow

Out of bounds Read

Weakness Enumeration

CWE-190

CWE-125

Related Identifiers

CVE-2020-0128

Affected Products

Android

References · 4

• https://source.android.com/security/bulletin/pixel/2020-06-01 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-0128 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-0128 · Security Note
• https://t.me/cibsecurity/12686 · Telegram Post