PT-2015-2219 · Google · Android

Publicado 2015-10-01 · Atualizado 2015-10-01 · CVE-2015-3832

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Android versions prior to 5.1.1 LMY48I

Description The issue is caused by multiple buffer overflows in the libstagefright library of the Android operating system. Exploitation of these issues may allow a remote attacker to execute arbitrary code using specially crafted MP4 data. The vulnerability is specifically related to invalid size values of NAL units in MP4 data.

Recommendations For Android versions prior to 5.1.1 LMY48I, update to version 5.1.1 LMY48I or later to resolve the issue. As a temporary workaround, consider restricting the use of MP4 data from untrusted sources to minimize the risk of exploitation.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

BDU:2015-11565

CVE-2015-3832

Produtos afetados

Android

Referências · 4

• https://android.googlesource.com/platform/frameworks/av/+/d48f0f145f8f0f4472bc0af668ac9a8bce44ba9b · Aviso do Fabricante
• https://groups.google.com/forum/message/raw?msg=android-security-updates/Ugvu3fi6RQM/yzJvoTVrIQAJ · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2015-11565 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2015-3832 · Nota de Segurança