Vulnerability Details : CVE-2015-1474
Multiple integer overflows in the GraphicBuffer::unflatten function in platform/frameworks/native/libs/ui/GraphicBuffer.cpp in Android through 5.0 allow attackers to gain privileges or cause a denial of service (memory corruption) via vectors that trigger a large number of (1) file descriptors or (2) integer values.
Vulnerability category: Memory CorruptionDenial of service
Products affected by CVE-2015-1474
- cpe:2.3:o:google:android:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2015-1474
0.92%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 83 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2015-1474
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
10.0
|
HIGH | AV:N/AC:L/Au:N/C:C/I:C/A:C |
10.0
|
10.0
|
NIST |
CWE ids for CVE-2015-1474
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2015-1474
-
http://www.securityfocus.com/bid/72788
Google Android 'GraphicBuffer::unflatten()' Function Multiple Integer Overflow VulnerabilitiesThird Party Advisory;VDB Entry
-
http://packetstormsecurity.com/files/130778/Google-Android-Integer-Oveflow-Heap-Corruption.html
Google Android Integer Oveflow / Heap Corruption ≈ Packet StormExploit;Third Party Advisory;VDB Entry
-
https://www.blackhat.com/docs/us-15/materials/us-15-Gong-Fuzzing-Android-System-Services-By-Binder-Call-To-Escalate-Privilege.pdf
-
https://android.googlesource.com/platform/frameworks/native/+/38803268570f90e97452cd9a30ac831661829091
38803268570f90e97452cd9a30ac831661829091 - platform/frameworks/native - Git at GoogleIssue Tracking;Patch
-
http://seclists.org/fulldisclosure/2015/Mar/63
Full Disclosure: [CVE-2015-1474]Integer overflow leading to heap corruption while unflattening GraphicBufferThird Party Advisory;VDB Entry
-
http://www.securitytracker.com/id/1031875
Google Android Integer Overflows in GraphicBuffer::unflatten() Let Remote Users Execute Arbitrary Code - SecurityTrackerThird Party Advisory;VDB Entry
Jump to