CVE detail
CVE-2015-1538
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android before 5.1.1 LMY48I allows remote attackers to execute arbitrary code via crafted atoms in MP4 data that trigger an unchecked multiplication, aka internal bug 20139950, a related issue to CVE-2015-4496.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 20.8 · diversity 8.0 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 0
- within the 30d window
- Peak daily
- 0
- highest bucket
Evidence
Source links by recency
7 source links · newest first
Experts at software research firm NorthBit have developed what they believe to be a reliable exploit for a Stagefright vulnerability affecting Google’s Android operating system.
newswww.securityweek.comMar 17, 2016, 6:37 PM- A billion Android devices vulnerable to Stagefright 2.0 bugsSecurity Affairs
A billion Android phones are vulnerable to Stagefright 2.0 flaws that could be exploited by attackers to execute malicious code on the targeted device. Do you remember the Stagefright vulnerability? In July 2015, security experts from Zimperium discovered the Stagefright flaw in the popular Google Android OS which allows hackers to gain control of the system without raising […]
newssecurityaffairs.comOct 2, 2015, 1:58 PM Here’s an overview of some of last week’s most interesting news and articles:Hacker had access to sensitive info about Firefox bugs for over a yearMozilla has announced that an attacker managed to access security-sensitive information about a considerable number of (at the time) unpatched Firefox vulnerabilities, and that there is evidence that at least one of them has been exploited in attacks in the wild.Android ransomware masquerades as Adult Player app, takes photo of victimA … More →
newswww.helpnetsecurity.comSep 13, 2015, 11:27 PM- Zimperium firm released the Android Stagefright Exploit CodeSecurity Affairs
Zimperium firm released the Android Stagefright Exploit Code, the Android flaw that is threatening the users of the popular Google mobile OS. Experts at Zimperium Mobile Security Labs (zLabs) recently discovered a critical flaw, dubbed Stagefright affecting the Android OS. The experts revealed that the Stagefright flaw (CVE-2015-1538) potentially affects 95% of Android devices running version 2.2 to 5.1 of […]
newssecurityaffairs.comSep 12, 2015, 9:07 AM - Attack code for critical Android Stagefright flaw publishedHelp Net Security
After having graciously waited for quite a while to publish the exploit for the Android Stagefright vulnerability (CVE-2015-1538) so that Google, mobile carriers and device manufacturers might push out a patch and protect users, Zimperium researchers have released the code on Wednesday.The company announced the existence of the bug in late July, and researcher Joshua Drake demonstrated how the vulnerability can be exploited via multiple attack vectors on Black Hat and DEF CON in August.The … More →
newswww.helpnetsecurity.comSep 10, 2015, 2:34 AM - Android Stagefright Exploit ReleasedSecurityWeek
Enterprise mobile security firm Zimperium has published an exploit for one of the most critical Android Stagefright vulnerabilities disclosed this summer.
newswww.securityweek.comSep 9, 2015, 4:44 PM A patch released by Google for one of the recently disclosed Stagefright vulnerabilities affecting the Android mobile operating system is flawed, researchers have warned.
newswww.securityweek.comAug 14, 2015, 12:02 PM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2014-9924CVSS 7.8 · High
In 1x in all Android releases from CAF using the Linux kernel, a Signed to Unsigned Conversion Error could potentially occur.
- CVE-2015-9002CVSS 7.8 · High
In TrustZone an out-of-range pointer offset vulnerability can potentially occur in a DRM routine in all Android releases from CAF using the Linux kernel.
- CVE-2014-9876CVSS 7.8 · High
drivers/char/diag/diagfwd.c in the Qualcomm components in Android before 2016-08-05 on Nexus 5, 5X, 6, 6P, and 7 (2013) devices mishandles certain integer values, which allows att…
- CVE-2016-2507CVSS 7.8 · High
Integer overflow in codecs/on2/h264dec/source/h264bsd_storage.c in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x befor…
- CVE-2015-8891CVSS 7.8 · High
Multiple integer overflows in app/aboot/aboot.c in the Qualcomm components in Android before 2016-07-05 on Nexus 5 and 7 (2013) devices allow attackers to bypass intended access r…
- CVE-2015-8888CVSS 7.8 · High
Integer overflow in app/aboot/aboot.c in the Qualcomm components in Android before 2016-07-05 on Nexus 5 devices allows attackers to bypass intended access restrictions via a craf…