PT-2015-2229 · Google · Android

Publicado 2015-10-01 · Atualizado 2015-10-01 · CVE-2015-1536

Positive Technologies (AI Summary)

CVSS v2.0

8.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:C

Name of the Vulnerable Software and Affected Versions Android versions prior to 5.1.1 LMY48I

Description The issue is related to an integer overflow in the Bitmap createFromParcel function, which can be exploited by attackers to cause a denial of service, resulting in a system server crash, or to obtain sensitive system server memory content information. This can be achieved through a crafted application that leverages improper unmarshalling of bitmaps. The exploitation of this issue may allow a remote attacker to cause a denial of service or gain access to device memory information using a specially formed application.

Recommendations For Android versions prior to 5.1.1 LMY48I, update to version 5.1.1 LMY48I or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

BDU:2015-11575

CVE-2015-1536

Produtos afetados

Android

Referências · 4

• https://android.googlesource.com/platform/frameworks/base/+/d44e5bde18a41beda39d49189bef7f2ba7c8f3cb · Aviso do Fabricante
• https://groups.google.com/forum/message/raw?msg=android-security-updates/Ugvu3fi6RQM/yzJvoTVrIQAJ · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-1536 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-11575 · Nota de Segurança