CVE-2019-11932 android-gif-drawable Double Free vulnerability
Remote attackers can execute arbitrary code or cause denial of service via a crafted GIF image in the android-gif-drawable library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-11932?
CVE-2019-11932 is a high-severity use after free vulnerability in koral-- android-gif-drawable, published on 3 Oct 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A double free vulnerability in the DDGifSlurp function in decoding.c in the android-gif-drawable library before version 1.2.18, as used in WhatsApp for Android before version 2.19.244 and many other Android applications, allows remote attackers to execute arbitrary code or cause a denial of service when the library is used to parse a specially crafted GIF image.
Weakness: CWE-415
Which versions are affected by CVE-2019-11932?
2 open source packages ship an affected version, including pl.droidsonroids.gif:android-gif-drawable. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
pl.droidsonroids.gif:android-gif-drawable Maven | All versions | 1.2.18 |
pl.droidsonroids.gif:android-gif-drawable Maven | All versions | 1.2.18 |
Products include Android-Gif-Drawable Project Android-Gif-Drawable, Whatsapp Whatsapp.
How do I fix CVE-2019-11932?
Upgrade pl.droidsonroids.gif:android-gif-drawable to 1.2.18 or later.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2019-11932 being exploited?
There is no known exploitation of CVE-2019-11932 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry and 16 proofs of concept on GitHub.
Other vulnerabilities in koral-- android-gif-drawable
Sources
Also known as GHSA-x534-j49x-mqvj.