CVE-2015-6602: Input Validation
Published Oct 2, 2015
·Updated
libutils in Android through 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted metadata in a (1) MP3 or (2) MP4 file, as demonstrated by an attack against use of libutils by libstagefright in Android 5.x.
Affected Software
2 affected components
Google Android<=5.1.1
Google Android
Event History
Oct 1, 2015
News Published
via Threatpost·11:00 AM
Oct 2, 2015
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Oct 5, 2015
Data Sourced
via Android·12:00 AM
SeverityAffected Software
Frequently Asked Questions
1
What would an attacker need to do to exploit this issue?
An attacker would need to provide a crafted MP3 or MP4 file whose metadata is processed by the affected libutils code. The listed attack vector is network-based and requires no authentication.
2
Which Android versions are identified as affected?
The affected scope is Android through 5.1.1 LMY48M. The demonstrated attack path involves libstagefright use of libutils in Android 5.x.
3
What impact could successful exploitation have?
Successful exploitation could allow remote execution of arbitrary code. The supplied severity vector indicates complete compromise of confidentiality, integrity, and availability.