CVE-2015-6602

libutils in Android through 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted metadata in a (1) MP3 or (2) MP4 file, as demonstrated by an attack against use of libutils by libstagefright in Android 5.x.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.3 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:C/I:C/A:C
google_androidCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 81%
VendorProductVersion
googleandroid
𝑥
≤ 5.1.1
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
android-platform-frameworks-native
bookworm
unimportant
bullseye
unimportant
sid
unimportant
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
android
wily
ignored
vivid
ignored
trusty
dne
precise
dne
Common Weakness Enumeration
References
http://www.securitytracker.com/id/1033725
https://blog.zimperium.com/zimperium-zlabs-is-raising-the-volume-new-vulnerability-processing-mp3mp4-media/
https://support.silentcircle.com/customer/en/portal/articles/2145864-privatos-1-1-12-release-notes
https://threatpost.com/stagefright-2-0-vulnerabilities-affect-1-billion-android-devices/114863/
http://www.securitytracker.com/id/1033725
https://blog.zimperium.com/zimperium-zlabs-is-raising-the-volume-new-vulnerability-processing-mp3mp4-media/
https://support.silentcircle.com/customer/en/portal/articles/2145864-privatos-1-1-12-release-notes
https://threatpost.com/stagefright-2-0-vulnerabilities-affect-1-billion-android-devices/114863/