CVE-2015-3876: Input Validation
Published Oct 2, 2015
·Updated
libstagefright in Android through 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted metadata in a (1) MP3 or (2) MP4 file.
Affected Software
2 affected components
Google Android<=5.1.1
Google Android
Event History
Oct 2, 2015
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Oct 5, 2015
Data Sourced
via Android·12:00 AM
SeverityAffected Software
Frequently Asked Questions
1
Which Android releases are affected?
The issue affects Android through 5.1.1 LMY48M.
2
What must an attacker provide to exploit this issue?
An attacker must supply a crafted MP3 or MP4 file containing malicious metadata. The vulnerability is remotely exploitable and does not require authentication.
3
What is the potential impact of successful exploitation?
Successful exploitation can allow remote attackers to execute arbitrary code, with confidentiality, integrity, and availability impacts indicated as complete.