CVE-2015-2001

CRITICAL

MetaIO SDK <6.0.2.1 - Code Injection

Title source: llm

Description

The MetaIO SDK before 6.0.2.1 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function.

References (2)

[Third Party Advisory] https://alephsecurity.com/vulns/aleph-2015002

[Technical Description, Third Party Advisory] https://www.usenix.org/system/files/conference/woot15/woot15-paper-peles.pdf

Scores

CVSS v3 9.8

EPSS 0.0109

EPSS Percentile 77.7%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

CWE

CWE-118

Status published

Affected Products (1)

metaio/metaio_sdk < 6.0.2.1

Timeline

Published Mar 29, 2018

Tracked Since Feb 18, 2026