CVE-2015-3875
libutils in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or...
libutils in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted audio file, aka internal bug 22952485.
Exploit likelihood
What each source reports
NVD Score used
libutils in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted audio file, aka internal bug 22952485.
- Record
CVE-2015-3875- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
libutils in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted audio file, aka internal bug 22952485.
- Record
CVE-2015-3875- Updated
- 2026-11-02
EUVDEUVD-2015-3911 No score
libutils in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted audio file, aka internal bug 22952485.
- Record
EUVD-2015-3911- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-phpx-7j69-h6m3 No score
libutils in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or...
libutils in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted audio file, aka internal bug 22952485.
- Record
GHSA-phpx-7j69-h6m3- Weakness
- CWE-119
- Updated
- 2026-11-02
OSV No score
libutils in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted audio file, aka internal bug 22952485.
- Record
CVE-2015-3875- Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-3875 No score
libutils in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted audio file, aka internal bug 22952485.
- Record
DEBIAN-CVE-2015-3875- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-3875 No score
libutils in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted audio file, aka internal bug 22952485.
- Record
UBUNTU-CVE-2015-3875- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
android-platform-frameworks-nativeDebian:12 |
All versions, plus listed versions 1:10.0.0+r36-11:10.0.0+r36-1.11:10.0.0+r36-1.1~exp11:10.0.0+r36-1.1~exp21:10.0.0+r36-1.2 |
None known |
androidUbuntu:16.04:LTS |
All versions, plus listed versions 20150818-1500-0ubuntu220150818-1500-0ubuntu320160307-0742-0ubuntu320160330-0939-0ubuntu1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-3875 is a high vulnerability (CVSS 10.0) in Google Android, published October 6, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.02%, the 81st percentile. No source names a fixed version.
References
groups.google.com/forum/message/raw?msg=android-security-updates/_Rm-lKnS2M8/dGTcilt0CAAJ
nvd.nist.gov/vuln/detail/CVE-2015-3875
github.com/advisories/GHSA-phpx-7j69-h6m3
security-tracker.debian.org/tracker/CVE-2015-3875
ubuntu.com/security/CVE-2015-3875
android.googlesource.com/platform/system/core/+/0cc9a6e6e1f8e675c1238e5e05418cabcc699b52%5E!
cve.org/CVERecord?id=CVE-2015-3875