Google Continues to Patch Stagefright Flaws in Android
NEWS ANALYSIS: Months after Google issued its first Stagefright patches, more libstagefright vulnerabilities have emerged and more are likely to surface.Google came out with its monthly Android security update, and once again, there is a fix for Stagefright (technically libstagefright) vulnerabilities. In total, Google is providing patches for 18 uniquely identified Common Vulnerabilities and Exposures (CVEs). Google first committed to issue monthly Android updates in August in the aftermath of the initial disclosure around Stagefright. The initial Stagefright vulnerabilities were first publicly disclosed in July by Joshua Drake, vice president of Platform Research and Exploitation at Zimperium zLabs. From a technical perspective, libstagefright is a media library that has been a common part of Google's mobile operating system since the Android 2.2 release. Google patched the initial set of libstagefright flaws that Drake reported in August, but additional flaws have been revealed in the intervening months. In Google's October Android update, 19 vulnerabilities were patched, including multiple Stagefright issues, and the company patched even more Stagefright bugs in its November Android update. In the December Android update, Google is patching four new libstagefright vulnerabilities. One is CVE-2015-6620, a privilege escalation flaw in libstagefright that was first reported to Google on Sept. 2, 2015.
The December Android update also includes patches for three information disclosure vulnerabilities: CVE-2015-6626, CVE-2015-6631 and CVE-2015-6632. The CVE-2015-6631 issue was first reported to Google on Aug. 21 while CVE-2015-6626 was reported on Sept. 2. Google is not disclosing the date that CVE-2015-6632 was reported.