CVE-2019-2004
Last modified
CVE-2019-2004 is a vulnerability of currently unknown severity. In publishKeyEvent, publishMotionEvent and sendUnchainedFinishedSignal of InputTransport.cpp, there are uninitialized data leading to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9Android ID: A-115739809. EPSS estimates a 0.17% chance of exploitation in the next 30 days.
Description
In publishKeyEvent, publishMotionEvent and sendUnchainedFinishedSignal of InputTransport.cpp, there are uninitialized data leading to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9Android ID: A-115739809
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Android | 7.0 | |
| Android | 7.1.1 | |
| Android | 7.1.2 | |
| Android | 8.0 | |
| Android | 8.1 | |
| Android | 9.0 |
References
- https://source.android.com/security/bulletin/2019-03-01Vendor Advisory
- https://source.android.com/security/bulletin/2019-03-01Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-2004?
How severe is CVE-2019-2004?
How do I fix CVE-2019-2004?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-20029An exploitable privilege escalation vulnerability exists in …8.8
- CVE-2019-2003In addLinks of Linkify.java, there is a possible phishing ve…
- CVE-2019-20030An attacker with knowledge of the modem access number on a N…7.8
- CVE-2019-20031NEC UM8000, UM4730 and prior non-InMail voicemail systems wi…9.1
- CVE-2019-20032An attacker with access to an InMail voicemail box equipped …6.5
- CVE-2019-20033On Aspire-derived NEC PBXes, including all versions of SV810…9.8
- CVE-2019-20041wp_kses_bad_protocol in wp-includes/kses.php in WordPress be…9.8
- CVE-2019-20042In wp-includes/formatting.php in WordPress 3.7 to 5.3.0, the…6.1
- CVE-2019-20043In in wp-includes/rest-api/endpoints/class-wp-rest-posts-con…4.3
- CVE-2019-20044In Zsh before 5.8, attackers able to execute commands can re…7.8
- CVE-2019-20045The Synergy Systems & Solutions PLC & RTU system has a vulne…7.5
- CVE-2019-20046The Synergy Systems & Solutions PLC & RTU system has a vulne…9.8
Are you affected by CVE-2019-2004?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST