CVE-2015-3867

libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted…

published October 6, 2015

CVSS
—
EPSS
2%
Percentile
79.1
In the wild
Unconfirmed
What it is

⚠️ An unassuming media file could turn into a digital grenade! Prior to Android 5.1.1, libstagefright is vulnerable, allowing attackers to execute arbitrary code just by having you click play. 😱 Think of it like a seemingly harmless sandwich at a picnic that, when bitten into, releases a hidden explosion — one moment you’re enjoying yourself, and the next, chaos ensues! An attacker could potentially take control of your device or crash it entirely, leading to a denial of service. This means your phone could become unresponsive, leaving you helpless at a critical moment.

Put simply

Think of it like a seemingly harmless sandwich at a picnic that, when bitten into, releases a hidden explosion — one moment you’re enjoying yourself, and the next, chaos ensues! This vulnerability exists due to memory corruption within libstagefright, which allows remote attackers to execute arbitrary code by delivering a crafted media file to the target device.

What to do

An attacker could potentially take control of your device or crash it entirely, leading to a denial of service. This means your phone could become unresponsive, leaving you helpless at a critical moment. To mitigate this vulnerability, it’s crucial to update your Android device to version 5.1.1 LMY48T or later. If you're a developer, ensure you implement proper validation and sanitization of media files before playback. You've got this! Keep your devices updated and secure to stay one step ahead of potential threats. 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01858 · 79.1th percentile
Published
2015-10-06T17:00Z
EPSS history
Timeline
  • 06 OCT 17:00Z
    libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted…
    cvelistv5