FCC, FTC Investigate Mobile Security Update Practices

The glowing lack of public, real-world Stagefright exploits didn’t stop the U.S. government from using last summer’s blockbuster Android vulnerability as an illustration of the dangers facing mobile device users. Under the context of Stagefright exposing up to 1 billion devices to attack, the...

FCC takes initiative to Speed Up Mobile Security Updates

In Brief The Smartphone users are fed up with slow security updates, so two United States federal agencies have launched an official inquiry to know how manufacturers and carriers deal with mobile phone security updates and what they are doing to roll out patches as quickly as possible. The...

UBUNTU-CVE-2016-2450

codecs/on2/enc/SoftVPXEncoder.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not validate OMX buffer sizes, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining...

Google Patches More Trouble in Mediaserver

Google has re-branded its monthly patch release, bringing a new name and new scope to the newly renamed Android Security Bulletin. While that may be new, the content is definitely familiar. Once again, critical remote code execution Mediaserver vulnerabilities dominate this month’s patches...

DEBIAN-CVE-2016-2814

Heap-based buffer overflow in the stagefright::SampleTable::parseSampleCencInfo function in libstagefright in Mozilla Firefox before 46.0, Firefox ESR 38.x before 38.8, and Firefox ESR 45.x before 45.1 allows remote attackers to execute arbitrary code via crafted CENC offsets that lead to...

Firefox ESR 45.x < 45.1 Multiple Vulnerabilities

The version of Firefox ESR installed on the remote Windows host is 45.x prior to 45.1. It is, therefore, affected by multiple vulnerabilities : - Multiple memory corruption issues exist that allow an attacker to corrupt memory, resulting in the execution of arbitrary code. CVE-2016-2806,...

Firefox ESR < 38.8 Multiple Vulnerabilities (Mac OS X)

The version of Firefox ESR installed on the remote Mac OS X host is prior to 38.8. It is, therefore, affected by multiple vulnerabilities : - Multiple memory corruption issues exist that allow an attacker to corrupt memory, resulting in the execution of arbitrary code. CVE-2016-2805, CVE-2016-280...

Firefox ESR < 38.8 Multiple Vulnerabilities

The version of Firefox ESR installed on the remote Windows host is prior to 38.8. It is, therefore, affected by multiple vulnerabilities : - Multiple memory corruption issues exist that allow an attacker to corrupt memory, resulting in the execution of arbitrary code. CVE-2016-2805, CVE-2016-2807...

UBUNTU-CVE-2016-2814

Heap-based buffer overflow in the stagefright::SampleTable::parseSampleCencInfo function in libstagefright in Mozilla Firefox before 46.0, Firefox ESR 38.x before 38.8, and Firefox ESR 45.x before 45.1 allows remote attackers to execute arbitrary code via crafted CENC offsets that lead to...

CVE-2016-2814

Heap-based buffer overflow in the stagefright::SampleTable::parseSampleCencInfo function in libstagefright in Mozilla Firefox before 46.0, Firefox ESR 38.x before 38.8, and Firefox ESR 45.x before 45.1 allows remote attackers to execute arbitrary code via crafted CENC offsets that lead to...

Metaphor - Stagefright with ASLR bypass

Metaphor - Stagefright with ASLR bypass By Hanan Be'er from NorthBit Ltd. Link to whitepaper: https://raw.githubusercontent.com/NorthBit/Public/master/NorthBit-Metaphor.pdf Metaphor's source code is now released! The source include a PoC that generates MP4 exploits in real-time and bypassing ASLR...

2015 Google Android Security Report

Last year was a landmark time for Android security. Google dealt with a major vulnerability in Stagefright, launched a monthly patch release and vulnerability rewards program, and continued to chip away at the number of malicious applications that find their way onto devices. Given all of that...

UBUNTU-CVE-2016-0842

The H.264 decoder in libstagefright in Android 6.x before 2016-04-01 mishandles Memory Management Control Operation MMCO data, which allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted media file, aka internal bug 25818142...

The vulnerability of the Android operating system, which allows a perpetrator to obtain confidential information or bypass security mechanisms

The vulnerability of the libstagefright library in the Android operating system is related to security configuration errors. Exploiting this vulnerability can allow a malicious actor, acting remotely, to obtain confidential information or bypass security mechanisms using specially crafted Bitstre...

April 2016 Google Android Nexus Security Bulletin

Google has patched a vulnerability being exploited in the wild to root Nexus 5 Android devices. The public exploit—a rooting application—was privately disclosed to Google on March 15 by Zimperium researchers, and a less than a month after CORE Team researchers reported that CVE-2015-1805, which w...

Stagefright Detector - Runtime command execution, Suspicious files, Unsafe deleting vulnerabilities

HackApp vulnerability scanner discovered that application Stagefright Detector published at the 'play' market has multiple vulnerabilities...

Google Android 5.0.1 - Metaphor Stagefright (ASLR Bypass)

Google Android 5.0.1 - Metaphor Stagefright ASLR Bypass Source: https://github.com/NorthBit/Metaphor Metaphor - Stagefright with ASLR bypass By Hanan Be'er from NorthBit Ltd. Link to whitepaper: https://raw.githubusercontent.com/NorthBit/Public/master/NorthBit-Metaphor.pdf Twitter:...

Android 5.0.1 - Metaphor Stagefright Exploit (ASLR Bypass)

Exploit for Android platform in category remote exploits Source: https://github.com/NorthBit/Metaphor Metaphor - Stagefright with ASLR bypass By Hanan Be'er from NorthBit Ltd. Link to whitepaper: https://raw.githubusercontent.com/NorthBit/Public/master/NorthBit-Metaphor.pdf Twitter:...

Google Android 5.0.1 - Metaphor Stagefright (ASLR Bypass)

Source: https://github.com/NorthBit/Metaphor Metaphor - Stagefright with ASLR bypass By Hanan Be'er from NorthBit Ltd. Link to whitepaper: https://raw.githubusercontent.com/NorthBit/Public/master/NorthBit-Metaphor.pdf Twitter: https://twitter.com/HighByte Metaphor's source code is now released! T...

Stagefright Variant 'Metaphor' Puts Millions Of Samsung, LG and HTC Phones At Risk

Millions of Android users are at risk of a new Metaphor exploit that can take over Samsung, LG and HTC phones in under 20 seconds. The hack gives attackers access to the targeted phones including the ability to inject malware and take control over key smartphone functions. Discovered by...