Vulnerability in Google Android
CVE-2015-1528
Integer overflow in the native_handle_create function in libcutils/native_handle.c in Android before 5.1.1 LMY48M allows attackers to obtain a different application's privileges or cause a denial of service (Binder heap memory corruption) via a crafted application, aka internal bug 19334482.
Published · last modified .
CVSS v2 metric
CVSS v2 base score 9.3 (High). Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.030 (87.0th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 87th percentile — 87.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.027 · newest: 0.030 · change: +0.003
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- groups.google.com/forum/message/raw (Vendor Advisory, mailing-list)
- android.googlesource.com/platform/frameworks/native/+/7dcd0ec9c91688cfa3f679804… (Vendor Advisory)
- android.googlesource.com/platform/system/core/+/e8c62fb484151f76ab88b1d5130f38d… (Vendor Advisory)
- www.blackhat.com/docs/us-15/materials/us-15-Gong-Fuzzing-Android-System-Service…
Frequently asked questions
- What is CVE-2015-1528?
- CVE-2015-1528 is a vulnerability in Google Android, classified under CWE-189. Published 2015-10-01.
- Is CVE-2015-1528 known to be exploited?
- 15 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.