CVE-2019-9365
In Bluetooth, there is a possible deserialization error due to missing string validation. This...
In Bluetooth, there is a possible deserialization error due to missing string validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-109838537
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In Bluetooth, there is a possible deserialization error due to missing string validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-109838537
- Record
CVE-2019-9365- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-502
- Updated
- 2026-11-02
CVE List No score
In Bluetooth, there is a possible deserialization error due to missing string validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-109838537
- Record
CVE-2019-9365- Updated
- 2026-11-02
EUVDEUVD-2019-18740 No score
In Bluetooth, there is a possible deserialization error due to missing string validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-109838537
- Record
EUVD-2019-18740- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x536-8h76-p7p2 No score
In Bluetooth, there is a possible deserialization error due to missing string validation. This...
In Bluetooth, there is a possible deserialization error due to missing string validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-109838537
- Record
GHSA-x536-8h76-p7p2- Updated
- 2026-11-02
OSVMGASA-2020-0128 No score
Updated pure-ftpd packages fix security vulnerabilities
Updated pure-ftpd packages fix security vulnerabilities:
An issue was discovered in Pure-FTPd 1.0.49. An uninitialized pointer vulnerability has been detected in the diraliases linked list. When the *lookup_alias(const char alias) or print_aliases(void) function is called, they fail to correctly detect the end of the linked list and try to access a non-existent list member. This is related to init_aliases in diraliases.c. (CVE-2019-9274).
An issue was discovered in Pure-FTPd 1.0.49. An out-of-bounds (OOB) read has been detected in the pure_strcmp function in utils.c (CVE-2019-9365).
In Pure-FTPd 1.0.49, a stack exhaustion issue was discovered in the listdir function in ls.c (CVE-2019-20176).
- Record
MGASA-2020-0128- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pure-ftpdMageia:7 From an advisory covering 3 CVEs |
before 1.0.47-7.mga7 | 1.0.47-7.mga7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-9365 is a critical vulnerability (CVSS 9.8) in Google Android, published September 27, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.97%, the 61st percentile. No source names a fixed version.