Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in Android prior to 5.1.1 LMY48M allows remote malicious users to execute arbitrary code via crafted MPEG-4 data, aka internal bug 23034759. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3824.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
google android |
One step forward, two steps back
Mobile security biz Zimperium reckons 600 to 850 million Android devices are still vulnerable to a Stagefright flaw that lets webpages and videos inject malware into phones and tablets. Stagefright is a software library buried deep within Android that processes multimedia files. It is used by a key Android component called mediaserver, which runs with higher access to the device than normal apps. When Stagefright is fed specially crafted video files, such as from a text message or website, these...
Paper lays out how to bypass Google's ASLR
A group of Israeli researchers reckon they've cracked the challenge of crafting a reliable exploit for the Stagefright vulnerability that emerged in Android last year. In a paper [PDF] that's a cookbook on how to build the exploit for yourself, they suggest millions of unpatched Android devices are vulnerable to their design, which bypasses Android's security defenses. Visiting a hacker's webpage is enough to trigger a system compromise, we're told. Since no hot piece of infosec action exists wi...
Update flawed, new one needed for countless gadgets
Google's security update to fix the Stagefright vulnerability in millions of Android smartphones is buggy – and a new patch is needed. The Stagefright flaw is named after a component within the Android operating system that, among other things, processes incoming text messages that contain video clips. By sending a vulnerable Android device a specially crafted multimedia message, it is possible to inject and execute malicious code on that gadget. It affects Android 2.2 to 5.1, so about 950 mil...
Vulmon