PT-2015-2203 · Google · Android+1

Publicado 2015-10-02 · Atualizado 2016-12-08 · CVE-2015-3876

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Android versions through 5.1.1 LMY48M

Description The issue exists due to insufficient input validation in the libstagefright library of the Android operating system. It allows a remote attacker to execute arbitrary code by using specially crafted metadata in MP3 or MP4 files.

Recommendations For Android versions through 5.1.1 LMY48M, consider restricting access to MP3 and MP4 files from untrusted sources to minimize the risk of exploitation. As a temporary workaround, avoid using the libstagefright library until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2015-11549

CVE-2015-3876

Produtos afetados

Android

Libstagefright

Referências · 6

• http://securitytracker.com/id/1033725 · Nota
• https://groups.google.com/forum/#!topic/android-security-updates/iv1BF0f0XY4 · Nota
• https://bdu.fstec.ru/vul/2015-11549 · Nota de Segurança
• http://twitter.com/4Dgifts/statuses/649589185792339968 · Nota
• https://code.google.com/p/android/issues/detail?id=182386 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-3876 · Nota de Segurança