Entreprise française de cybersécurité depuis 2004
☎ 03 60 47 09 81 - info@securiteinfo.com

CVE-2015-3864

Description

Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in Android before 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted MPEG-4 data, aka internal bug 23034759. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3824.

POC

Reference

- https://www.exploit-db.com/exploits/38226/

- https://www.exploit-db.com/exploits/39640/

- https://www.exploit-db.com/exploits/40436/

Github

- https://github.com/ARPSyndicate/cvemon

- https://github.com/Bhathiya404/Exploiting-Stagefright-Vulnerability-CVE-2015-3864

- https://github.com/Cmadhushanka/CVE-2015-3864-Exploitation

- https://github.com/HenryVHuang/CVE-2015-3864

- https://github.com/HighW4y2H3ll/libstagefrightExploit

- https://github.com/eudemonics/scaredycat

- https://github.com/hac425xxx/heap-exploitation-in-real-world

- https://github.com/hoangcuongflp/MobileSecurity2016-recap

- https://github.com/pwnaccelerator/stagefright-cve-2015-3864

- https://github.com/reshu-523357/Operating_system