CVE-2015-3828
HighSummary
The MPEG4Extractor::parse3GPPMetaData function in libstagefright in Android before version 5.1.1 LMY48I does not enforce a minimum size for UTF-16 strings containing a Byte Order Mark (BOM). This allows remote attackers to execute arbitrary code or cause a denial of service via crafted 3GPP metadata.
Risk Assessment
This vulnerability may lead to remote code execution or denial of service, posing a serious security threat to systems running the vulnerable version of Android.
Recommendation
It is recommended to update Android to version 5.1.1 LMY48I or later to mitigate this vulnerability.
Other vulnerabilities in libstagefright
See all- CVE-2017-0409High
CVE-2017-0409 is a vulnerability in the libstagefright library that allows an attacker to execute arbitrary code remotely using a specially crafted file in the context of an unprivileged process. This issue is rated as High due to the potential for remote code execution in applications using this library.
- CVE-2016-3872High
Buffer overflow in SoftVPX.cpp in libstagefright in mediaserver in Android before version 4.4.4, 5.0.2, 5.1.1, 2016-09-01 for 6.x, and 2016-09-01 for 7.0 allows attackers to gain privileges via a crafted application.
- CVE-2016-3863High
Multiple stack-based buffer overflows in the AVCC reassembly implementation in libstagefright in Android allow remote attackers to execute arbitrary code via a crafted media file.
- CVE-2016-3824High
The OMXNodeInstance.cpp file in libstagefright in mediaserver in Android versions before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 does not validate the buffer port, allowing attackers to gain privileges via a crafted application.
- CVE-2016-2507High
Integer overflow in libstagefright in Android before version 4.4.4, 5.0.2, 5.1.1, and 6.x before July 1, 2016 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted media file.
- CVE-2016-2485High
libstagefright in mediaserver in Android versions before 4.4.4, 5.0.2, 5.1.1, and before June 1, 2016, does not validate OMX buffer sizes for GSM and G711 codecs. This allows attackers to gain privileges via a crafted application.
- CVE-2016-2451High
In libstagefright in Android before version 4.4.4, 5.0.2, 5.1.1, and 6.x before May 1, 2016, VPX output buffer sizes are not validated, allowing attackers to gain privileges via a crafted application.
- CVE-2016-2814High
A heap-based buffer overflow in the libstagefright library in Mozilla Firefox before version 46.0, Firefox ESR 38.x before 38.8, and Firefox ESR 45.x before 45.1 allows remote attackers to execute arbitrary code via crafted CENC offsets that lead to mismanagement of the sizes table.
- CVE-2016-0842High
The H.264 decoder in libstagefright in Android 6.x before 2016-04-01 mishandles Memory Management Control Operation (MMCO) data, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
- CVE-2015-6620High
libstagefright in Android before 5.1.1 LMY48Z and 6.0 before December 1, 2015, allows attackers to gain privileges via a crafted application. This can lead to obtaining Signature or SignatureOrSystem access.
Original NVD description (English source)
The MPEG4Extractor::parse3GPPMetaData function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I does not enforce a minimum size for UTF-16 strings containing a Byte Order Mark (BOM), which allows remote attackers to execute arbitrary code or cause a denial of service (integer underflow and memory corruption) via crafted 3GPP metadata, aka internal bug 20923261, a related issue to CVE-2015-3826.