Vulnerabilities > CVE-2015-3829 - Numeric Errors vulnerability in Google Android

047910
CVSS 10.0 - CRITICAL
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
low complexity
google
CWE-189
critical

Summary

Off-by-one error in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I allows remote attackers to execute arbitrary code or cause a denial of service (integer overflow and memory corruption) via crafted MPEG-4 covr atoms with a size equal to SIZE_MAX, aka internal bug 20923261.

Common Weakness Enumeration (CWE)

The Hacker News

idTHN:6EF19BF277B793F5A36108AF7A72F0D4
last seen2018-01-27
modified2015-09-11
published2015-09-11
reporterKhyati Jain
sourcehttps://thehackernews.com/2015/09/stagefright-android-exploit-code.html
titleAndroid Stagefright Exploit Code Released