Skip to main content
cvebuzz

CVE mentions, exploit signals, and PoC evidence in one fast public view.

CVE detail

CVE-2015-3864

Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in Android before 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted MPEG-4 data, aka internal bug 23034759. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3824.

CVSS 10.0 · CriticalBuzz score 24.4

Buzz score

Why this CVE is surfacing

Buzz score total 24.4

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 17.9 · diversity 6.5 · KEV 0.0 · OTX 0.0 · PoC 0.0
Mention score
17.9
5 evidence mentions in the snapshot
Diversity score
6.5
2 sources across 1 categories
KEV score
0.0
No KEV entry observed
OTX score
0.0
0 OTX pulses
PoC score
0.0
0 repos · best confidence N/A
Best PoC traction
0
Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions
0
within the 30d window
Peak daily
0
highest bucket

Evidence

Source links by recency

Newest mentions first
5 source links · newest first
  • New Stagefright exploit puts millions of Android devices at riskCSO Online

    Millions of Android devices are at risk yet again after researchers found a new way to exploit an older vulnerability that was previously patched by Google. NorthBit, based in Herzliya, Israel, published a paper outlining Metaphor, a nickname for a new weakness they found in Stagefright, Android’s mediaserver and multimedia library. The attack is effective against devices […]

    newswww.csoonline.comMar 18, 2016, 11:56 AM
  • Reliable Exploit Developed for Android Stagefright FlawSecurityWeek

    Experts at software research firm NorthBit have developed what they believe to be a reliable exploit for a Stagefright vulnerability affecting Google’s Android operating system.

    newswww.securityweek.comMar 17, 2016, 6:37 PM
  • Android Stagefright Exploit ReleasedSecurityWeek

    Enterprise mobile security firm Zimperium has published an exploit for one of the most critical Android Stagefright vulnerabilities disclosed this summer.

    newswww.securityweek.comSep 9, 2015, 4:44 PM
  • Android Stagefright Vulnerability Not Patched Properly by GoogleSecurityWeek

    A patch released by Google for one of the recently disclosed Stagefright vulnerabilities affecting the Android mobile operating system is flawed, researchers have warned.

    newswww.securityweek.comAug 14, 2015, 12:02 PM
  • Google has another try at patching Stagefright flawCSO Online

    Google has released another patch for the Stagefright vulnerability after a security firm said the first one didn’t fix it. Hundreds of millions of Android devices are vulnerable to Stagefright. A device can be compromised merely through the receipt of a specially crafted multimedia message (MMS), so an attacker needs only the victim’s phone number. […]

    newswww.csoonline.comAug 14, 2015, 10:47 AM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

0 repository references · best confidence N/A · max 0 stars
No public PoC repositories have been matched yet.

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence
  • CVE-2014-9924

    In 1x in all Android releases from CAF using the Linux kernel, a Signed to Unsigned Conversion Error could potentially occur.

    CVSS 7.8 · High
  • CVE-2015-9002

    In TrustZone an out-of-range pointer offset vulnerability can potentially occur in a DRM routine in all Android releases from CAF using the Linux kernel.

    CVSS 7.8 · High
  • CVE-2014-9876

    drivers/char/diag/diagfwd.c in the Qualcomm components in Android before 2016-08-05 on Nexus 5, 5X, 6, 6P, and 7 (2013) devices mishandles certain integer values, which allows att…

    CVSS 7.8 · High
  • CVE-2016-2507

    Integer overflow in codecs/on2/h264dec/source/h264bsd_storage.c in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x befor…

    CVSS 7.8 · High
  • CVE-2015-8891

    Multiple integer overflows in app/aboot/aboot.c in the Qualcomm components in Android before 2016-07-05 on Nexus 5 and 7 (2013) devices allow attackers to bypass intended access r…

    CVSS 7.8 · High
  • CVE-2015-8888

    Integer overflow in app/aboot/aboot.c in the Qualcomm components in Android before 2016-07-05 on Nexus 5 devices allows attackers to bypass intended access restrictions via a craf…

    CVSS 7.8 · High