CVE-2015-3849: Critical severity Google Android vulnerability
Published Sep 9, 2015
·Updated
The RegioncreateFromParcel function in core/jni/android/graphics/Region.cpp in Region in Android before 5.1.1 LMY48M does not check the return values of certain read operations, which allows attackers to execute arbitrary code via an application that sends a crafted message to a service, aka internal bug 21585255.
Affected Software
2 affected components
Google Android<=5.1
Google Android
Event History
Sep 9, 2015
CVE Published
via Android·12:00 AM
Data Sourced
via Android·12:00 AM
SeverityAffected Software
Oct 1, 2015
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
Which Android versions are affected?
Android versions before 5.1.1 build LMY48M are affected.
2
What does an attacker need to exploit this issue?
An attacker needs to cause an application to send a crafted message to a service. The provided vector indicates that no authentication is required.
3
What is the potential impact of successful exploitation?
Successful exploitation can allow arbitrary code execution, with potential compromise of confidentiality, integrity, and availability.