CVE-2015-3864
Google Android - libstagefright Integer Overflow Remote Code Execution
Severity Score
8.8
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
9
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in Android before 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted MPEG-4 data, aka internal bug 23034759. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3824.
Desbordamiento de entero inferior en la función MPEG4Extractor::parseChunk en MPEG4Extractor.cpp en libstagefright en mediaserver en Android en versiones anteriores a 5.1.1 LMY48M permite a atacantes remotos ejecutar código arbitrario a través de datos MPEG-4 manipulados, también conocido como error interno 23034759. NOTA: esta vulnerabilidad existe debido a una solución incompleta para la CVE-2015-3824.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2015-05-12 CVE Reserved
- 2015-10-01 CVE Published
- 2016-03-30 First Exploit
- 2024-08-06 CVE Updated
- 2025-03-18 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-189: Numeric Errors
CAPEC
References (14)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/76682 | Vdb Entry | |
| https://blog.zimperium.com/cve-2015-3864-metasploit-module-now-available-for-testing | Release Notes | |
| https://blog.zimperium.com/reflecting-on-stagefright-patches | X_refsource_misc |
| URL | Date | SRC |
|---|---|---|
| https://packetstorm.news/files/id/138853 | 2016-09-27 | |
| https://www.exploit-db.com/exploits/38226 | 2024-08-06 | |
| https://www.exploit-db.com/exploits/40436 | 2024-08-06 | |
| https://www.exploit-db.com/exploits/39640 | 2024-08-06 | |
| https://github.com/HenryVHuang/CVE-2015-3864 | 2016-03-30 | |
| https://github.com/Cmadhushanka/CVE-2015-3864-Exploitation | 2024-07-10 | |
| https://github.com/Bhathiya404/Exploiting-Stagefright-Vulnerability-CVE-2015-3864 | 2023-02-09 | |
| https://github.com/pwnaccelerator/stagefright-cve-2015-3864 | 2016-11-01 | |
| https://github.com/eudemonics/scaredycat | 2024-08-12 |
| URL | Date | SRC |
|---|