| Vulnerability Name: | CVE-2015-3864 (CCN-106489) | ||||||||
| Assigned: | 2015-09-17 | ||||||||
| Published: | 2015-09-17 | ||||||||
| Updated: | 2017-09-16 | ||||||||
| Summary: | Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in Android before 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted MPEG-4 data, aka internal bug 23034759. Note: this vulnerability exists because of an incomplete fix for CVE-2015-3824. | ||||||||
| CVSS v3 Severity: | 9.8 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) 9.1 Critical (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C)
| ||||||||
| CVSS v2 Severity: | 10.0 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
| ||||||||
| Vulnerability Type: | CWE-189 | ||||||||
| Vulnerability Consequences: | Gain Access | ||||||||
| References: | Source: CCN Type: Zimperium Mobile Security Blog, Monday, Jul 27 2015 at 13:02 Experts Found a Unicorn in the Heart of AndroidExperts Found a Unicorn in the Heart of Android Source: MITRE Type: CNA CVE-2015-3864 Source: CCN Type: CNNMoney (New York) July 28, 2015: 10:32 AM ET Android phones can be hacked with a simple text Source: BID Type: UNKNOWN 76682 Source: CCN Type: SECURITYWEEK, August 14, 2015 Android Stagefright Vulnerability Not Patched Properly by Google Source: CCN Type: WIRED Security Hack Brief: The Android Text Attack Source: CCN Type: Google Android GIT repositories android Git repositories Source: CONFIRM Type: Vendor Advisory https://android.googlesource.com/platform/frameworks/av/+/6fe85f7e15203e48df2cc3e8e1c4bc6ad49dc968 Source: MISC Type: Release Notes, Third Party Advisory https://blog.zimperium.com/cve-2015-3864-metasploit-module-now-available-for-testing/ Source: MISC Type: UNKNOWN https://blog.zimperium.com/reflecting-on-stagefright-patches/ Source: XF Type: UNKNOWN google-android-cve20153864-overflow(106489) Source: MLIST Type: Vendor Advisory [android-security-updates] 20150909 Nexus Security Bulletin (September 2015) Source: CCN Type: Packet Storm Security [09-27-2016] Android Stagefright MP4 tx3g Integer Overflow Source: EXPLOIT-DB Type: EXPLOIT Offensive Security Exploit Database [09-17-2015] Source: EXPLOIT-DB Type: UNKNOWN 38226 Source: EXPLOIT-DB Type: EXPLOIT Offensive Security Exploit Database [03-30-2016] Source: EXPLOIT-DB Type: UNKNOWN 39640 Source: EXPLOIT-DB Type: EXPLOIT Offensive Security Exploit Database [09-27-2016] Source: EXPLOIT-DB Type: UNKNOWN 40436 Source: CCN Type: WhiteSource Vulnerability Database CVE-2015-3864 | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||
| Oval Definitions | |||||||||
| |||||||||
| BACK | |||||||||