CVE-2015-3840

The MessageStatusReceiver service in the AndroidManifest.XML in Android 5.1.1 and earlier allows local users to alter sent/received statuses of SMS and MMS messages without the associated "WRITE_SMS" permission.

• CWE-284

• http://blog.trendmicro.com/trendlabs-security-intelligence/os-x-zero-days-on-the-rise-a-2015-midyear-review-on-advanced-attack-surfaces/Third Party Advisory
• http://blog.trendmicro.com/trendlabs-security-intelligence/two-new-android-bugs-mess-up-messaging-may-lead-to-multiple-send-charges/Exploit, Third Party Advisory
• https://huntcve.github.io/2017/02/13/cveupdate/Broken Link
• http://blog.trendmicro.com/trendlabs-security-intelligence/os-x-zero-days-on-the-rise-a-2015-midyear-review-on-advanced-attack-surfaces/Third Party Advisory
• http://blog.trendmicro.com/trendlabs-security-intelligence/two-new-android-bugs-mess-up-messaging-may-lead-to-multiple-send-charges/Exploit, Third Party Advisory
• https://huntcve.github.io/2017/02/13/cveupdate/Broken Link

Published

Jun 27, 2017

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-3833The getRunningAppProcesses function in services/core/java/co…
• CVE-2015-3834Multiple integer overflows in the BnHDCP::onTransact functio…
• CVE-2015-3835Buffer overflow in the OMXNodeInstance::emptyBuffer function…
• CVE-2015-3836The Parse_wave function in arm-wt-22k/lib_src/eas_mdls.c in …
• CVE-2015-3837The OpenSSLX509Certificate class in org/conscrypt/OpenSSLX50…
• CVE-2015-3839The updateMessageStatus function in Android 5.1.1 and earlie…
• CVE-2015-3842Multiple heap-based buffer overflows in libeffects in the Au…
• CVE-2015-3843The SIM Toolkit (STK) framework in Android before 5.1.1 LMY4…
• CVE-2015-3844The getProcessRecordLocked method in services/core/java/com/…
• CVE-2015-3845The Parcel::appendFrom function in libs/binder/Parcel.cpp in…
• CVE-2015-3847Bluetooth in Android before 5.1.1 LMY48T allows attackers to…
• CVE-2015-3849The Region_createFromParcel function in core/jni/android/gra…