PT-2015-2219 · Google · Android

Published 2015-10-01 · Updated 2015-10-01 · CVE-2015-3832

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Android versions prior to 5.1.1 LMY48I

Description The issue is caused by multiple buffer overflows in the libstagefright library of the Android operating system. Exploitation of these issues may allow a remote attacker to execute arbitrary code using specially crafted MP4 data. The vulnerability is specifically related to invalid size values of NAL units in MP4 data.

Recommendations For Android versions prior to 5.1.1 LMY48I, update to version 5.1.1 LMY48I or later to resolve the issue. As a temporary workaround, consider restricting the use of MP4 data from untrusted sources to minimize the risk of exploitation.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2015-11565

CVE-2015-3832

Affected Products

Android

References · 4

• https://android.googlesource.com/platform/frameworks/av/+/d48f0f145f8f0f4472bc0af668ac9a8bce44ba9b · Vendor Advisory
• https://groups.google.com/forum/message/raw?msg=android-security-updates/Ugvu3fi6RQM/yzJvoTVrIQAJ · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-11565 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-3832 · Security Note