Google May 2019 Patches address 4 RCE flaws in Android

Android May 2019 Patches address critical vulnerabilities in the Google operating system, including 4 remote code execution flaws.

Google released May 2019 patches address 8 critical flaws in Google operating system, including 4 remote code execution vulnerabilities.

Google is not aware of attacks in the wild exploiting these flaws.

According to the advisory released by Google, the most severe bug affects the Media framework. An attacker could exploit the flaw, tracked as
CVE-2019-2044, using a specially crafted file to execute arbitrary code within the context of a privileged process.

“The most severe of these issues is a critical security vulnerability in Media framework that could enable a remote attacker using a specially crafted file to execute arbitrary code within the context of a privileged process.” reads the advisory.

The vulnerability affects Android 7.0, 7.1.1, 7.1.2, 8.0, 8.1, and 9 and was addressed on all devices running the Android 2019-05-01 security patch level.

Google also addressed three critical remote code execution vulnerabilities (CVE-2019-2045, CVE-2019-2046, and CVE-2019-2047) in the System component that impact Android 7.0, 7.1.1, 7.1.2, 8.0, 8.1, and 9.

Google May 2019 patches also fix 5 high severity bugs in System, tracked as CVE-2019-2049, CVE-2019-2050, CVE-2019-2051, CVE-2019-2052, CVE-2019-2053.

CVE-2019-2049 and CVE-2019-2050 are elevation of privilege flaws, the CVE-2019-2051, CVE-2019-2052, and CVE-2019-2053 are information disclosure flaws.

The Android 2019-05-01 security patch level also addresses a Moderate risk elevation of privilege vulnerability in Framework.

The flaw, tracked as CVE-2019-2043, could enable a local malicious application to bypass user interaction requirements in order to gain access to additional permissions.

Google also addressed vulnerabilities in Kernel components, NVIDIA components, Broadcom components, Qualcomm components, and Qualcomm closed-source components.

The most severe flaws are four critical vulnerabilities in Qualcomm closed-source components tracked as CVE-2018-5912, CVE-2018-13898, CVE-2019-2255, and CVE-2019-2256.

The Pixel Update Bulletin for May 2019 contains no security patches.

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – Android, Google May 2019 Patches)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.