10
CVSSv2

CVE-2015-3824

Published: 01/10/2015 Updated: 21/09/2017
CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10
VMScore: 890
Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Summary

The MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in Android prior to 5.1.1 LMY48I does not properly restrict size addition, which allows remote malicious users to execute arbitrary code or cause a denial of service (integer overflow and memory corruption) via a crafted MPEG-4 tx3g atom, aka internal bug 20923261.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

google android

Recent Articles

Trend publishes analysis of yet another Android media handling bug
The Register • John Leyden • 18 Aug 2015

1, 2, 3, 4 ... how many more bugs must we endure?

More details have emerged about yet another Android vulnerability, that, like other recent flaws, revolves around how the Google-backed mobile operating system handles media files. The Android Mediaserver vulnerability might be exploited to perform attacks involving arbitrary code execution, security researchers at Trend Micro warn. The security bug (CVE-2015-3842) affects Android versions 2.3 to 5.1.1, so hundreds of thousands of devices are potentially at risk. The danger potentially comes fro...