CVE-2019-5282
High
Description
Bastet module of some Huawei smartphones with Versions earlier than Emily-AL00A 9.0.0.182(C00E82R1P21), Versions earlier than Emily-TL00B 9.0.0.182(C01E82R1P21), Versions earlier than Emily-L09C 9.0.0.203(C432E7R1P11), Versions earlier than Emily-L29C 9.0.0.203(C432E7R1P11), Versions earlier than Emily-L29C 9.0.0.202(C185E2R1P12) have a double free vulnerability. An attacker tricks the user into installing a malicious application, which frees on the same memory address twice. Successful exploit could result in malicious code execution.
SeverityHigh
CVSS7.8
Exploit probability—
ProductHuawei Emily-al00a Firmware
PublishedNov 13, 2019
First seenNov 13, 2019
How to fix
Update
- huawei emily-al00a_firmwareemily-al00a_9.0.0.182\(c00e82r1p21\) or later
- huawei emily-tl00b_firmwareemily-tl00b_9.0.0.182\(c01e82r1p21\) or later
- huawei emily-l09c_firmwareemily-l09c_9.0.0.203\(c432e7r1p11\) or later
- huawei emily-l29c_firmwareemily-l29c_9.0.0.203\(c432e7r1p11\), emily-l29c_9.0.0.202\(c185e2r1p12\), emily-l29c_9.0.0.207\(c636e7r1p13\), emily-l29c_9.0.0.205\(c635e2r1p11\) or later
- huawei hima-l09ca_firmwarehima-l09ca_9.0.0.198\(c432e10r1p16\) or later
- huawei hima-l29ca_firmwarehima-l29ca_9.0.0.198\(c432e10r1p16\) or later
- huawei hima-l29c_firmwarehima-l29c_9.0.0.204\(c636e10r2p1\) or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| huawei emily-al00a_firmware | v < emily-al00a_9.0.0.182\(c00e82r1p21\) | emily-al00a_9.0.0.182\(c00e82r1p21\) |
| huawei emily-tl00b_firmware | v < emily-tl00b_9.0.0.182\(c01e82r1p21\) | emily-tl00b_9.0.0.182\(c01e82r1p21\) |
| huawei emily-l09c_firmware | v < emily-l09c_9.0.0.203\(c432e7r1p11\) | emily-l09c_9.0.0.203\(c432e7r1p11\) |
| huawei emily-l29c_firmware | v < emily-l29c_9.0.0.203\(c432e7r1p11\), v < emily-l29c_9.0.0.202\(c185e2r1p12\), v < emily-l29c_9.0.0.207\(c636e7r1p13\), v < emily-l29c_9.0.0.205\(c635e2r1p11\) | emily-l29c_9.0.0.203\(c432e7r1p11\), emily-l29c_9.0.0.202\(c185e2r1p12\), emily-l29c_9.0.0.207\(c636e7r1p13\), emily-l29c_9.0.0.205\(c635e2r1p11\) |
| huawei hima-l09ca_firmware | v < hima-l09ca_9.0.0.198\(c432e10r1p16\) | hima-l09ca_9.0.0.198\(c432e10r1p16\) |
| huawei hima-l29ca_firmware | v < hima-l29ca_9.0.0.198\(c432e10r1p16\) | hima-l29ca_9.0.0.198\(c432e10r1p16\) |
| huawei hima-l29c_firmware | v < hima-l29c_9.0.0.204\(c636e10r2p1\) | hima-l29c_9.0.0.204\(c636e10r2p1\) |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.