CVEvulnerability

CVE-2015-3827

9.3 HIGH Published 2015-10-01 Modified 2026-06-17 Official page ↗

Status: Modified
Published: 2015-10-01
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 2.0 ([email protected]): 9.3 HIGH — AV:N/AC:M/Au:N/C:C/I:C/A:C
Weaknesses: CWE-119, CWE-189

Description

The MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I does not validate the relationship between chunk sizes and skip sizes, which allows remote attackers to execute arbitrary code or cause a denial of service (integer underflow and memory corruption) via crafted MPEG-4 covr atoms, aka internal bug 20923261.

Affected configurations

• google android (<= 5.1)

Related

Weakness · not in database (1)

CWE-189

Weakness · CWE (1)

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness

References

http://www.huawei.com/en/psirt/security-advisories/hw-448928 www.huawei.com
http://www.securityfocus.com/bid/76052 www.securityfocus.com
http://www.securitytracker.com/id/1033094 www.securitytracker.com
http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-448928.htm www1.huawei.com
https://android.googlesource.com/platform/frameworks/av/+/f4a88c8ed4f8186b3d6e2852993e063fc33ff231 Vendor Advisory
https://groups.google.com/forum/message/raw?msg=android-security-updates/Ugvu3fi6RQM/yzJvoTVrIQAJ Vendor Advisory
http://www.huawei.com/en/psirt/security-advisories/hw-448928 www.huawei.com
http://www.securityfocus.com/bid/76052 www.securityfocus.com
http://www.securitytracker.com/id/1033094 www.securitytracker.com
http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-448928.htm www1.huawei.com
https://android.googlesource.com/platform/frameworks/av/+/f4a88c8ed4f8186b3d6e2852993e063fc33ff231 Vendor Advisory
https://groups.google.com/forum/message/raw?msg=android-security-updates/Ugvu3fi6RQM/yzJvoTVrIQAJ Vendor Advisory