CVE-2015-6600

libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted…

published October 6, 2015

CVSS
—
EPSS
2%
Percentile
78.6
In the wild
Unconfirmed
What it is

⚠️ A crafty media file could bring your Android device to its knees! Remote attackers can leverage libstagefright vulnerabilities in versions prior to 5.1.1 LMY48T to execute arbitrary code or cause a denial of service. 🔥 Think of libstagefright like a poorly designed movie theater that lets anyone barge in and take over the projector—an attacker could hijack your device and play whatever they want without a ticket! If exploited, an attacker could crash your device or run malicious code, leading to compromised data or personal information. This could be absolutely devastating, especially if you're using your device for sensitive tasks.

Put simply

Think of libstagefright like a poorly designed movie theater that lets anyone barge in and take over the projector—an attacker could hijack your device and play whatever they want without a ticket! This vulnerability in libstagefright allows attackers to cause memory corruption by sending a specially crafted media file, which can trigger remote code execution or a denial of service on unpatched Android devices.

What to do

If exploited, an attacker could crash your device or run malicious code, leading to compromised data or personal information. This could be absolutely devastating, especially if you're using your device for sensitive tasks. To protect yourself, update your Android to version 5.1.1 LMY48T or later. Regularly check for security updates from your device manufacturer and be cautious about the media files you open. You've got this! Just follow these steps, and you'll keep your device safe and sound. 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01820 · 78.6th percentile
Published
2015-10-06T17:00Z
EPSS history
Timeline
  • 06 OCT 17:00Z
    libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted…
    cvelistv5