CVE-2015-3827
Last modified
CVE-2015-3827 is a vulnerability of currently unknown severity. The MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I does not validate the relationship between chunk sizes and skip sizes, which allows remote attackers to execute arbitrary code or cause a denial of service (integer underflow and memory corruption) via crafted MPEG-4 covr atoms, aka internal bug 20923261.. EPSS estimates a 81.14% chance of exploitation in the next 30 days.
Description
The MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I does not validate the relationship between chunk sizes and skip sizes, which allows remote attackers to execute arbitrary code or cause a denial of service (integer underflow and memory corruption) via crafted MPEG-4 covr atoms, aka internal bug 20923261.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Android | <= 5.1 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2015-3827?
How severe is CVE-2015-3827?
How do I fix CVE-2015-3827?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2015
- CVE-2015-3814The (1) dissect_tfs_request and (2) dissect_tfs_response fun…
- CVE-2015-3815The detect_version function in wiretap/logcat.c in the Andro…
- CVE-2015-3823libstagefright in Android before 5.1.1 LMY48T allows remote …
- CVE-2015-3824The MPEG4Extractor::parseChunk function in MPEG4Extractor.cp…
- CVE-2015-3825Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2015-3826The MPEG4Extractor::parse3GPPMetaData function in MPEG4Extra…
- CVE-2015-3828The MPEG4Extractor::parse3GPPMetaData function in MPEG4Extra…
- CVE-2015-3829Off-by-one error in the MPEG4Extractor::parseChunk function …
- CVE-2015-3830The stock Android browser address bar in all Android operati…
- CVE-2015-3831Buffer overflow in the readAt function in BpMediaHTTPConnect…
- CVE-2015-3832Multiple buffer overflows in MPEG4Extractor.cpp in libstagef…
- CVE-2015-3833The getRunningAppProcesses function in services/core/java/co…
Are you affected by CVE-2015-3827?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST