CVE-2015-2004

CRITICAL

GNSDK SDK <1.1.7 - Code Injection

Title source: llm

Description

The GraceNote GNSDK SDK before SVN Changeset 1.1.7 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function.

References (2)

[Third Party Advisory] https://alephsecurity.com/vulns/aleph-2015005

[Technical Description, Third Party Advisory] https://www.usenix.org/system/files/conference/woot15/woot15-paper-peles.pdf

Scores

CVSS v3 9.8

EPSS 0.0109

EPSS Percentile 77.7%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

CWE

CWE-118

Status published

Affected Products (1)

gracenote/gnsdk < 1.1.7

Timeline

Published Mar 29, 2018

Tracked Since Feb 18, 2026