SB2019111350 - SQL injection in Google, Google Android
Published: November 13, 2019 Updated: November 15, 2019
Security Bulletin ID
SB2019111350
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) SQL injection (CVE-ID: CVE-2019-2211)
The vulnerability allows a local user to gain access to sensitive information on the target system.
The vulnerability exists within the "createProjectionMapForQuery" of TvProvider.java Framework functionality for Android due to insufficient sanitization of user-supplied data. A local user can send a specially crafted request to the affected application and disclose sensitive information on the target system.
Remediation
Install update from vendor's website.