The Patching Friars' AlmanacA calendar of CVE saints

August 5

StagefrightHoly card for stagefright, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 MMS Stagefright TIMOR SCAENAE
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Saint Stagefright, Who Had Stage Fright

Patron of MMS messages, videos that open themselves, and phones the manufacturer never updated.

Life

In the summer of 2015 Joshua Drake of Zimperium found a series of flaws in libstagefright, the library Android uses to read media files. Sending an MMS with a malformed video was enough: the phone processed it by itself to build the preview, and the attacker's code took the stage before the victim had even touched the screen. Nearly a billion devices were at risk, and ever since Google has published monthly security bulletins.

Prayer

O Saint Stagefright, who performs though nobody bought a ticket, keep our phones from opening what nobody asked to see. Amen.

How to celebrate

Celebrated by disabling MMS auto-download and installing this month's patch, if the manufacturer ever shipped it.

Automatic preview, curtains for the phone.

Technical record

Disclosed on
August 5 2015
CVE
CVE-2015-1538

Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android before 5.1.1 LMY48I allows remote attackers to execute arbitrary code via crafted atoms in MP4 data that trigger an unchecked multiplication, aka internal bug 20139950, a related issue to CVE-2015-4496.

Sources: projectzero.google · blog.zimperium.com · blackhat.com · blog.isosceles.com

Also remembered today

Shortcuts: ← → to move, D day, W week, M month, T today.

📅 Add to your calendar

Saints:Google CalendarApple, Outlook and others (.ics)

Observances (feasts, scourges and miracles):Google CalendarApple, Outlook and others (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.