PT-2015-6417 · Blackberry · Blackberry Link

Published 2015-07-20 · Updated 2017-09-22 · CVE-2015-4111

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BlackBerry Link versions prior to 1.2.3.53

Description The issue allows remote attackers to execute arbitrary code via a crafted MP4 file, specifically affecting the mc demux mp4 ds.ax component in an unspecified third-party codec demux.

Recommendations For versions prior to 1.2.3.53, update to version 1.2.3.53 or later to resolve the issue. Additionally, ensure the installer is updated to version 1.1.0.22 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2015-4111

Affected Products

Blackberry Link

References · 4

• http://blackberry.com/btsc/KB37207 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-4111 · Security Note
• http://securitytracker.com/id/1032969 · Note
• http://securityfocus.com/bid/75950 · Note