AddVorbisCodecInfo Function in Matroska/MatroskaExtractor.cpp in Libstagefright Vulnerability (CVE-2015-3861)

  Severity: MEDIUM
  CVE Identifier: CVE-2015-3861
  Advisory Date: APR 06, 2016

  DESCRIPTION

This vulnerability pertains to the multiple integer overflows in the addVorbisCodecInfo function in matroska/MatroskaExtractor.cpp in libstagefright in mediaserver in Android before 5.1.1 LMY48M. When exploited successfully, it could allow remote attackers denial of service (DoS).

Trend Micro researcher Wish Wu disclosed details about this vulnerability to Google. The said company acknowledged Wu’s research contribution.

  TREND MICRO PROTECTION INFORMATION

Apply associated Trend Micro DPI Rules.