CVE-2019-2051

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In heap of spaces.h, there is a possible out of bounds read due to improper input validation. This could lead to remote information disclosure when processing a proxy auto config file with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9 Android ID: A-117555811

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-20CWE-125

Affected software

No affected versions have been published.

Timeline

Published
May 8, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-205116.1ERPNext 11.1.47 allows blog?blog_category= Frame Injection.CVE-2019-205126.1Open edX Ironwood.1 allows support/certificates?course_id= reflected XSS.CVE-2019-205136.1Open edX Ironwood.1 allows support/certificates?user= reflected XSS.CVE-2019-205146.1ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the address/ URI.CVE-2019-205156.1ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the addresses/ URI.CVE-2019-205166.1ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the blog/ URI.CVE-2019-205176.1ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the contact/ URI.CVE-2019-205186.1ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the project/ URI.CVE-2019-205196.1ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the user/ URI, as demonstrated by a crafted e-mail address.CVE-2019-20527.5In VisitPointers of heap.cc, there is a possible out-of-bounds read due to type confusion. This could lead to remote information disclosure CVE-2019-205206.1ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/method/ URI.CVE-2019-205216.1ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/ URI.
CVE-2019-2051: High severity, CVSS 7.5 | Vulnix