The Patching Friars' AlmanacA calendar of CVE saints

Patron of August 5

StagefrightHoly card for stagefright, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 MMS Stagefright TIMOR SCAENAE
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Saint Stagefright, Who Had Stage Fright

Patron of MMS messages, videos that open themselves, and phones the manufacturer never updated.

Life

In the summer of 2015 Joshua Drake of Zimperium found a series of flaws in libstagefright, the library Android uses to read media files. Sending an MMS with a malformed video was enough: the phone processed it by itself to build the preview, and the attacker's code took the stage before the victim had even touched the screen. Nearly a billion devices were at risk, and ever since Google has published monthly security bulletins.

Prayer

O Saint Stagefright, who performs though nobody bought a ticket, keep our phones from opening what nobody asked to see. Amen.

How to celebrate

Celebrated by disabling MMS auto-download and installing this month's patch, if the manufacturer ever shipped it.

Automatic preview, curtains for the phone.

Technical record

Disclosed on
August 5 2015
CVE
CVE-2015-1538

Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android before 5.1.1 LMY48I allows remote attackers to execute arbitrary code via crafted atoms in MP4 data that trigger an unchecked multiplication, aka internal bug 20139950, a related issue to CVE-2015-4496.

Sources: projectzero.google · blog.zimperium.com · blackhat.com · blog.isosceles.com

📅 Add to your calendar

SaintsGoogle CalendarApple, Outlook (.ics)

Observances (feasts, scourges and miracles)Google CalendarApple, Outlook (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.