PT-2015-2203 · Google · Android+1

Published 2015-10-02 · Updated 2016-12-08 · CVE-2015-3876

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Android versions through 5.1.1 LMY48M

Description The issue exists due to insufficient input validation in the libstagefright library of the Android operating system. It allows a remote attacker to execute arbitrary code by using specially crafted metadata in MP3 or MP4 files.

Recommendations For Android versions through 5.1.1 LMY48M, consider restricting access to MP3 and MP4 files from untrusted sources to minimize the risk of exploitation. As a temporary workaround, avoid using the libstagefright library until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2015-11549

CVE-2015-3876

Affected Products

Android

Libstagefright

References · 6

• https://bdu.fstec.ru/vul/2015-11549 · Security Note
• https://code.google.com/p/android/issues/detail?id=182386 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-3876 · Security Note
• http://securitytracker.com/id/1033725 · Note
• https://groups.google.com/forum/#!topic/android-security-updates/iv1BF0f0XY4 · Note
• http://twitter.com/4Dgifts/statuses/649589185792339968 · Note