CVE-2015-3860: High severity Google Android vulnerability

Q: What is the severity of CVE-2015-3860?

CVE-2015-3860 has a medium severity rating due to its potential for unauthorized access.

Q: How do I fix CVE-2015-3860?

To fix CVE-2015-3860, update your Android device to version 5.1.1 or higher.

Q: What systems are affected by CVE-2015-3860?

CVE-2015-3860 affects Android versions 5.0 to 5.1.0.

Q: Can CVE-2015-3860 be exploited remotely?

CVE-2015-3860 can only be exploited by physically proximate attackers.

Q: What kind of attacks does CVE-2015-3860 enable?

CVE-2015-3860 enables attackers to bypass the lockscreen access by exploiting the password entry field.

Published Sep 9, 2015

Updated

packages/Keyguard/res/layout/keyguardpasswordview.xml in Lockscreen in Android 5.x before 5.1.1 LMY48M does not restrict the number of characters in the passwordEntry input field, which allows physically proximate attackers to bypass intended access restrictions via a long password that triggers a SystemUI crash, aka internal bug 22214934.

Affected Software

2 affected components

Google Android<=5.1

Google Android

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Android Lock screen to a version that resolves this vulnerability.
Fixed in 5.1.1 LMY48M

Event History

Sep 9, 2015

CVE Published

via Android·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityAffected Software

Oct 1, 2015

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2015-3860?

CVE-2015-3860 has a medium severity rating due to its potential for unauthorized access.

How do I fix CVE-2015-3860?