Google fixed Android vulnerabilities

    Google has released a security update for the Android Nexus Security Bulletin - December 2015 , which closes 19 vulnerabilities in the OS. Some of them are quite serious and allow attackers to remotely execute code on the device using specially crafted multimedia files, and these files can be delivered to the user via e-mail, web browser or MMS message.



    Vulnerability CVE-2015-6616 in the Mediaserver system component allows cybercriminals to remotely execute code with elevated privileges on the device by sending an MMS message (Remote Code Execution). Another critical LPE vulnerability in the kernel with the identifier CVE-2015-6619 allows the application to obtain maximum root privileges in the system and full access to all device resources. A similar type of vulnerability is used to perform a rooting operation.



    Several vulnerabilities were closed in the notorious libstagefright library. Previously, Google closed RCE vulnerabilities in this library, which led to remote code execution with maximum permissions in the system. Vulnerabilities in the Display Driver component are also critical, since they allow an attacker to remotely execute code using a special multimedia file delivered in various ways, including email, a web browser, and MMS messages.

    Vulnerabilities with High severity are of the types Elevation of Privilege (EoP, LPE) and Information Disclosure. In the first case, the attacker uses the familiarity in the component to obtain elevated privileges in the system, and in the second, in order to obtain inappropriate information bypassing Android security settings. Almost all vulnerabilities of this type provide an attacker with access to additional rights, for example, Signature or SignatureOrSystem.

    image
    be secure.

    Also popular now: