CVE-2015-3864: Critical severity Google Android vulnerability
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in Android before 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted MPEG-4 data, aka internal bug 23034759. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3824.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Androidto a version that resolves this vulnerability.Fixed in 5.1.1 LMY48M
Event History
Frequently Asked Questions
What is the severity of CVE-2015-3864?
CVE-2015-3864 has a high severity rating due to its potential for remote code execution.
How do I fix CVE-2015-3864?
To mitigate CVE-2015-3864, update to Android version 5.1.1 or higher.
What causes CVE-2015-3864?
CVE-2015-3864 is caused by an integer underflow in the MPEG4Extractor::parseChunk function.
Which Android versions are affected by CVE-2015-3864?
CVE-2015-3864 affects all Android versions prior to 5.1.1 LMY48M.
Can CVE-2015-3864 be exploited remotely?
Yes, CVE-2015-3864 can be exploited remotely via crafted MPEG-4 data.