CVE-2019-2228

In array_find of array.c, there is a possible out-of-bounds read due to an incorrect bounds check...

5.5 MediumFix available

In array_find of array.c, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local information disclosure in the printer spooler with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-111210196

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.20%Down 0.1 points since Apr 14, 2021

What each source reports

NVD Score used 5.5

Record: CVE-2019-2228
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0: 4.9 MediumAV:L/AC:L/Au:N/C:C/I:N/A:N
Weakness: CWE-125
Updated: 2026-11-02

CVE List No score

Record: CVE-2019-2228
Updated: 2026-11-02

EUVDEUVD-2019-11870 No score

Record: EUVD-2019-11870
Updated: 2026-11-03

GitHub AdvisoriesGHSA-6xpc-pxw7-qhg3 No score

In array_find of array.c, there is a possible out-of-bounds read due to an incorrect bounds check...

Record: GHSA-6xpc-pxw7-qhg3
Updated: 2026-11-02

OSV 5.5

Record: CVE-2019-2228
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVDEBIAN-CVE-2019-2228 5.5

Record: DEBIAN-CVE-2019-2228
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

Show 4 moreShow less

OSVUBUNTU-CVE-2019-2228 5.5

Record: UBUNTU-CVE-2019-2228
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVMGASA-2020-0248 No score

Updated cups packages fix security vulnerability

Updated cups packages fix security vulnerabilities:

It was discovered that CUPS incorrectly handled certain language values. A local attacker could possibly use this issue to cause CUPS to crash, leading to a denial of service, or possibly obtain sensitive information (CVE-2019-2228).

Stephan Zeisberg discovered that the CUPS SNMP backend incorrectly handled encoded ASN.1 inputs. A remote attacker could possibly use this issue to cause CUPS to crash by providing specially crafted network traffic (CVE-2019-8675, CVE-2019-8696).

The ippReadIO function may under-read an extension (CVE-2019-8842).

Stephan Zeisberg discovered that CUPS incorrectly handled certain malformed ppd files. A local attacker could possibly use this issue to execute arbitrary code (CVE-2020-3898).

The cups package has been updated to version 2.2.13 and patched to fix these issues and other bugs.

Also, this update will hopefully fix the cups service failing to start at boot on some systems.

Record: MGASA-2020-0248
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10707-1 No score

cups-2.3.3op2-4.2 on GA media

These are all security issues fixed in the cups-2.3.3op2-4.2 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10707-1
Updated: 2026-11-02

OSVUSN-4340-1 No score

cups vulnerabilities

Stephan Zeisberg discovered that CUPS incorrectly handled certain malformed ppd files. A local attacker could possibly use this issue to execute arbitrary code. (CVE-2020-3898)

Record: USN-4340-1
Updated: 2026-11-02

Affected products

google android

Affected packages

Affected packages
Package	Affected	Fixed
`cups` Debian:12	before 2.3.1-1	2.3.1-1
`cups` Debian:13	before 2.3.1-1	2.3.1-1
`cups` Debian:14	before 2.3.1-1	2.3.1-1
`cups` Debian:8	before 1.7.5-11+deb8u7, plus listed versions 1.7.5-111.7.5-11+deb8u11.7.5-11+deb8u21.7.5-11+deb8u31.7.5-11+deb8u41.7.5-11+deb8u51.7.5-11+deb8u6	1.7.5-11+deb8u7
`cups` Mageia:7 From an advisory covering 5 CVEs	before 2.2.13-1.2.mga7	2.2.13-1.2.mga7
`cups` Ubuntu:16.04:LTS	before 2.1.3-4ubuntu0.11, plus listed versions 2.1.0-4ubuntu32.1.0-52.1.0-62.1.0-6ubuntu12.1.0-7 Show 15 moreShow less 2.1.2-12.1.2-22.1.3-12.1.3-1build12.1.3-32.1.3-42.1.3-4ubuntu0.22.1.3-4ubuntu0.32.1.3-4ubuntu0.42.1.3-4ubuntu0.52.1.3-4ubuntu0.62.1.3-4ubuntu0.72.1.3-4ubuntu0.82.1.3-4ubuntu0.92.1.3-4ubuntu0.10	2.1.3-4ubuntu0.11
`cups` Ubuntu:18.04:LTS	before 2.2.7-1ubuntu2.8, plus listed versions 2.2.4-7ubuntu22.2.5-22.2.6-22.2.6-32.2.6-4 Show 10 moreShow less 2.2.6-52.2.7-1ubuntu12.2.7-1ubuntu22.2.7-1ubuntu2.12.2.7-1ubuntu2.22.2.7-1ubuntu2.32.2.7-1ubuntu2.42.2.7-1ubuntu2.52.2.7-1ubuntu2.62.2.7-1ubuntu2.7	2.2.7-1ubuntu2.8
`cups` Ubuntu:16.04:LTS From an advisory covering 2 CVEs	before 2.1.3-4ubuntu0.11, plus listed versions 2.1.0-4ubuntu32.1.0-52.1.0-62.1.0-6ubuntu12.1.0-7 Show 15 moreShow less 2.1.2-12.1.2-22.1.3-12.1.3-1build12.1.3-32.1.3-42.1.3-4ubuntu0.22.1.3-4ubuntu0.32.1.3-4ubuntu0.42.1.3-4ubuntu0.52.1.3-4ubuntu0.62.1.3-4ubuntu0.72.1.3-4ubuntu0.82.1.3-4ubuntu0.92.1.3-4ubuntu0.10	2.1.3-4ubuntu0.11
`cups` Ubuntu:18.04:LTS From an advisory covering 2 CVEs	before 2.2.7-1ubuntu2.8, plus listed versions 2.2.4-7ubuntu22.2.5-22.2.6-22.2.6-32.2.6-4 Show 10 moreShow less 2.2.6-52.2.7-1ubuntu12.2.7-1ubuntu22.2.7-1ubuntu2.12.2.7-1ubuntu2.22.2.7-1ubuntu2.32.2.7-1ubuntu2.42.2.7-1ubuntu2.52.2.7-1ubuntu2.62.2.7-1ubuntu2.7	2.2.7-1ubuntu2.8
`cups` Ubuntu:20.04:LTS From an advisory covering 2 CVEs	before 2.3.1-9ubuntu1.1, plus listed versions 2.2.12-2ubuntu12.3.0-62.3.0-72.3.0-7ubuntu12.3.1-1ubuntu1 Show 4 moreShow less 2.3.1-22.3.1-42.3.1-72.3.1-9ubuntu1	2.3.1-9ubuntu1.1
`cups` openSUSE:Tumbleweed From an advisory covering 20 CVEs	before 2.3.3op2-4.2	2.3.3op2-4.2

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-2228 is a medium vulnerability (CVSS 5.5) in Google Android, published December 6, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 10th percentile. Fixed in cups 2.3.1-1.

References

Show 31 moreShow less