CVE-2015-8506: Buffer Overflow

Q: Which Android releases are affected?

The issue affects Android versions before 5.1.1 build LMY48Z and Android 6.0 builds before the 2015-12-01 security update.

Q: What does an attacker need to exploit this issue?

An attacker needs to provide a crafted media file that is processed by mediaserver. The vulnerability can be exploited remotely and does not require authentication.

Q: What is the potential impact?

Successful exploitation can result in arbitrary code execution or a denial of service through memory corruption, with impacts to confidentiality, integrity, and availability.

Published Dec 8, 2015

Updated

mediaserver in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 24441553, a different vulnerability than CVE-2015-6616, CVE-2015-8505, and CVE-2015-8507.

Affected Software

2 affected components

Google Android>=5.0<5.1.1

Google Android=6.0

Event History

Dec 8, 2015

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

Description

Frequently Asked Questions

Which Android releases are affected?

The issue affects Android versions before 5.1.1 build LMY48Z and Android 6.0 builds before the 2015-12-01 security update.

What does an attacker need to exploit this issue?

An attacker needs to provide a crafted media file that is processed by mediaserver. The vulnerability can be exploited remotely and does not require authentication.

What is the potential impact?

Successful exploitation can result in arbitrary code execution or a denial of service through memory corruption, with impacts to confidentiality, integrity, and availability.

CVE-2015-8506: Buffer Overflow

Affected Software

Event History

Frequently Asked Questions

Which Android releases are affected?

What does an attacker need to exploit this issue?

What is the potential impact?

Company

Resources

Contact

Frequently Asked Questions

Which Android releases are affected?

What does an attacker need to exploit this issue?

What is the potential impact?