Patch Android! July 2019 update fixes 9 critical flaws
Depending on when users receive it, this week’s Android July 2019 patch update will fix 33 security vulnerabilities, including 9 marked critical, and 24 marked high.
If you own a Google Pixel device, that will be within a day or two, leaving everybody else on the 2019-07-01 and 2019-07-05 patch levels (what these dates mean is explained here) running Android 7, 8 or 9 to wait anything from weeks to months to catch up.
As usual, July’s batch of fixes covers flaws in significant parts of Android, including system, framework, library, and Qualcomm’s numerous components, including closed-source software.
However, as has been the case for some months, it’s the media framework that provides a disproportionate amount of the patching action in the form of three remote code execution (RCE) bugs marked critical.
These are CVE-2019-2107, CVE-2019-2106 (affecting Android 7 and 8), and CVE-2019-2109 (which only affects Android 9).
Another RCE critical is CVE-2019-2111 in the Android system, with the remaining critical flaws all connected to Qualcomm’s closed-source components.
In contrast to Microsoft’s Patch Tuesday, Google rarely offers much detail on individual flaws during the initial patch release, restricting itself to the following generalisation:
The most severe vulnerability in this section could enable a remote attacker using a specially crafted file to execute arbitrary code within the context of a privileged process.
Google is able to be this vague primarily because:
We have had no reports of active customer exploitation or abuse of these newly reported issues.
Anyone interested in knowing a bit more about these should check the flaw CVEs on the US National Vulnerability Database (NVD) in a week or two when more information is added on each vulnerability.
Alternatively, vendors publish their own advisories which often feature more device-specific information – see the July 2019 update advisories for Samsung, Nokia, Motorola, LG, and Huawei.
Huawei
If you own a Huawei device, these should receive this month’s update without issue. As for updates after August’s, the company is due to make an announcement soon (users can find more information on Huawei’s website).
Depending on the version of Android, a device’s patch level (2019-07-01 or 2019-07-05) can be determined in Settings About phone Android security patch level. For Android 9 it’s Settings System Advanced System updates.
Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/VcD8Nl6BnQM/