# MA-766.012020: MyCERT Advisory - Android Security Bulletin — December 2019

**Date:** 20 Jan 2020  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-766.012020  
**Advisory ID:** MA-766.012020

---

MyCERT Alert – Android December 2019 Security Update.
Date first published: 17/01/2020
1.0 Introduction
Google through Android Security Bulletin had published several security vulnerabilities affecting Android phone. 43 vulnerabilities has been reported:
1. Six (6) flaws in Framework component
|  |  |
| --- | --- | --- | --- | --- | No. | CVE | Bug Type | Severity | Android Version | 1 | CVE-2019-2232 | DoS | Critical | 8.0, 8.1, 9, 10 | 2 | CVE-2019-9464 | EoP | High | 10 | 3 | CVE-2019-2217 | EoP | High | 10 | 4 | CVE-2019-2218 | EoP | High | 10 | 5 | CVE-2019-2220 | ID | High | 9, 10 | 6 | CVE-2019-2221 | EoP | Moderate | 10 |
\*DoS – Denial of Service
\*\*EoP – Escalation of Privileges
\*\*\*ID – Information Disclosure
2. Two (2) flaws in Media framework
|  |  |
| --- | --- | --- | --- | --- | No. | CVE | Bug Type | Severity | Android Version | 1 | CVE-2019-2222 | RCE | Moderate | 10 | RCE | Critical | 8.0, 8.1, 9 | 2 | CVE-2019-2223 | RCE | Moderate | 10 | RCE | Critical | 8.0, 8.1, 9 |
\*RCE - Remote Code Execution
3. Eight (8) flaws in System components
|  |  |
| --- | --- | --- | --- | --- | No. | CVE | Bug Type | Severity | Android Version | 1 | CVE-2019-2224 | RCE | High | 8.0, 8.1, 9, 10 | 2 | CVE-2019-2225 | EoP | High | 8.0, 8.1, 9, 10 | 3 | CVE-2019-2226 | ID | High | 8.0, 8.1, 9, 10 | 4 | CVE-2019-2227 | ID | High | 9, 10 | 5 | CVE-2019-2228 | ID | High | 8.0, 8.1, 9, 10 | 6 | CVE-2019-2229 | ID | High | 8.0, 8.1, 9, 10 | 7 | CVE-2019-2230 | ID | High | 10 | 8 | CVE-2019-2231 | ID | High | 9, 10 |
\*RCE - Remote Code Execution
\*\*  EoP - Elevation of privilege
\*\*\* ID - Information Disclosure
4. Two (2) flaws in Google Play system updates components
|  |  |
| --- | --- | --- | --- | --- | No. | CVE | |
| 1 | CVE-2019-2222 | |
| 2 | CVE-2019-2223 | |
5. Three (3) bugs in Kernel components
|  |  |
| --- | --- | --- | --- | --- | No. | CVE | Bug Type | Severity | Component | 1 | CVE-2019-20961 | EoP | High | USB MIDI class function driver | 2 | CVE-2019-15220 | EoP | High | Prism54 WiFi USB Driver | 3 | CVE-2019-15239 | EoP | High | TCP Stack |
6. Twelve (12) bugs in Qualcomm’s driver components
|  |  |
| --- | --- | --- | --- | --- | No. | CVE | Bug Type | Severity | Component | 1 | CVE-2019-10557 | N/A | High | WLAN host | 2 | CVE-2019-11980 | N/A | High | WLAN host | 3 | CVE-2019-10480 | N/A | High | WLAN host | 4 | CVE-2019-10481 | N/A | High | WLAN host | 5 | CVE-2019-10536 | N/A | High | WLAN host | 6 | CVE-2019-10537 | N/A | High | WLAN host | 7 | CVE-2019-10595 | N/A | High | WLAN host | 8 | CVE-2019-10598 | N/A | High | WLAN host | 9 | CVE-2019-10601 | N/A | High | WLAN host | 10 | CVE-2019-10605 | N/A | High | WLAN host | 11 | CVE-2019-10607 | N/A | High | Security | 12 | CVE-2019-2304 | N/A | High | WLAN host |
\*N/A - Not Available
7. Ten (10) bugs in Qualcomm closed-source component.
|  |  | --- | --- | --- | --- | No. | CVE | Bug Type | Severity | 1 | CVE-2019-2242 | N/A | Critical | 2 | CVE-2019-10500 | N/A | Critical | 3 | CVE-2019-10525 | N/A | Critical | 4 | CVE-2019-10482 | N/A | High | 5 | CVE-2019-10487 | N/A | High | 6 | CVE-2019-10516 | N/A | High | 7 | CVE-2019-2274 | N/A | High | 8 | CVE-2019-10513 | N/A | High | 9 | CVE-2019-10517 | N/A | High | 10 | CVE-2019-10600 | N/A | High |
\*N/A - Not Available
2.0 Impact
2.1 For reported vulnerabilities in Framework components, it could enable  a remote attacker to cause permanent denial of service using a specially crafted message.
2.2 For reported vulnerabilities in Media components, it could enable a remote attacker to execute arbitrary code within the context of privileged process using a specially crafted file.
2.3 For reported vulnerabilities in System components,  it could enable a remote attacker to execute arbitrary code within the context of unprivileged process using a specially crafted file.
2.4 For reported vulnerabilities in Google Play system update components, it could enable a remote attacker using a specially crafted file to execute arbitrary code within the context of privileged process.
2.5 For reported vulnerabilities in Kernel components could enable a local malicious application to execute arbitrary code within the context of a privileged process.
2.7 For reported vulnerabilities in Qualcomm’s driver components, these vulnerabilities are described in further detail in the appropriate Qualcomm security bulletin or security alert.
3.0 Affected System and devices
3.1 Android phone:
- Version from 8.0 up to 10
- All Android version 8.0 and below are no longer supported with security updates.
- With security patch level is dated prior to 01 December 2019.
3.2 To check current security patch installed:
- Android 8 and prior:
- Settings → About phone →  Android security patch level
- Android 9 onward:
- Settings → System → Advanced → System updates
\* Please note that each manufacturer may have relocated this information somewhere else.
4.0 Recommendations
4.1 Android phone users are advised to update their devices to the latest version whenever it’s available
1. It's up to the device manufacturer, and mobile carrier if appropriate, to approve and pass on fixes.
2. Certain Google devices, primarily Pixel and older Nexus devices, get them directly from Google itself, and its Play services can in some cases push patches straight to the devices.
4.2 General best practice for smartphone users:
1. Verify an app's permission before installing it i.e. online banking app shouldn’t require access to camera, microphone and SMS permission.
2. Do not click on adware or suspicious URL sent through SMS/messaging services. Malicious program could be attached to collect user's information.
3. Verify given URLs with the official financial institution or law enforcement agency website. On mobile, site URL may appear differently from desktop browser, make sure to verify it too.
4. Always run a reputable anti-virus on your smartphone/mobile devices, and keep it up to date regularly.
5. Don't use public Wi-Fi networks for bank transactions and turn off Bluetooth connection when not in use. These can be open windows for eavesdroppers intercepting the transaction or installing spyware and other malware on user's smartphone/tablet.
6. Update the operating system and applications on smartphone/tablet, including the browser, in order to avoid any malicious exploits of security holes in out-dates versions.
7. Do not root or otherwise 'Jailbreak' your phone. This give administrator privileges to access the device filesystem and malicious app could take advantage.
8. Avoid side loading (installing from non-official sources) when you can. If you do install Android software from other sources than the official app store, be sure that it is coming from a reputable source.
9. Please ensure to turn off the “Unknown Source” option in the Security Settings page.
Generally, MyCERT advises the users of these devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection) or [[email protected]](/cdn-cgi/l/email-protection)
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 89453442
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 -18:00 MYT
Web: [http://www.mycert.org.my](https://www.google.com/url?q=http://www.mycert.org.my/&sa=D&ust=1579080795930000)
Twitter: [http://www.twitter.com/mycert](https://www.google.com/url?q=http://www.twitter.com/mycert&sa=D&ust=1579080795930000)
Facebook: [http://www.facebook.com/mycert.org.my](https://www.google.com/url?q=http://www.facebook.com/mycert.org.my&sa=D&ust=1579080795930000)
Cyber999 Mobile Apps: [IOS Users](https://www.google.com/url?q=https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt%3D8%26ign-mpt%3Duo%253D4&sa=D&ust=1579080795931000) or [Android Users](https://www.google.com/url?q=https://play.google.com/store/apps/details?id%3Dmy.cyber999.mobile&sa=D&ust=1579080795931000)
5.0    References
- [https://source.android.com/security/bulletin/2019-12-01.html](https://www.google.com/url?q=https://source.android.com/security/bulletin/2019-12-01.html&sa=D&ust=1579080795932000)
- [https://nakedsecurity.sophos.com/2019/12/05/critical-dos-messaging-flaw-fixed-in-december-android-update/](https://www.google.com/url?q=https://nakedsecurity.sophos.com/2019/12/05/critical-dos-messaging-flaw-fixed-in-december-android-update/&sa=D&ust=1579080795933000)
- [https://threatpost.com/google-critical-android-permanent-dos-flaw/150764/](https://www.google.com/url?q=https://threatpost.com/google-critical-android-permanent-dos-flaw/150764/&sa=D&ust=1579080795933000)