CVE-2015-6636

mediaserver in Android 5.x before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory…

published January 6, 2016

CVSS
—
EPSS
2%
Percentile
81.1
In the wild
Unconfirmed
What it is

🔍 A crafted media file can turn your Android 5.x or 6.0 device into a playground for attackers! Think of it like a movie theater that will play any film without checking for content — a single bad reel could cause chaos, and in this case, it’s the media file that’s causing the trouble! An attacker could execute arbitrary code on your device or even crash the entire mediaserver, resulting in a denial of service. This can allow malicious actors to gain control over your device or disrupt its functionality, which is absolutely devastating.

Put simply

Think of it like a movie theater that will play any film without checking for content — a single bad reel could cause chaos, and in this case, it’s the media file that’s causing the trouble! The vulnerability in mediaserver allows remote attackers to exploit memory corruption via specially crafted media files, leading to arbitrary code execution or service interruption.

What to do

An attacker could execute arbitrary code on your device or even crash the entire mediaserver, resulting in a denial of service. This can allow malicious actors to gain control over your device or disrupt its functionality, which is absolutely devastating. To protect yourself, ensure your device is updated to Android 5.1.1 LMY49F or later. Regularly apply security updates and be cautious about the media files you open, especially from untrusted sources. You've got this! By keeping your device updated and vigilant, you'll be a security hero in no time! 🦸‍♂️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02060 · 81.1th percentile
Published
2016-01-06T19:00Z
EPSS history
Timeline
  • 06 JAN 19:00Z
    mediaserver in Android 5.x before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory…
    cvelistv5