Google has released a security update for Android

Google released the second monthly security update for Android ( Nexus Security Bulletin - September 2015 ), which, first of all, is addressed to Nexus native devices. The update fixes 8 vulnerabilities, one of which is CVE-2015-3636 of the Elevation of Privilege type, is present in the OS kernel and is already at the stage of active exploitation by hackers. Using this vulnerability, attackers can elevate their privileges in the system (Local Privilege Escalation).



In the last update for Android, Google fixed a series of so-called. Stagefright vulnerabilities that allowed attackers to remotely execute their code in Android by sending a specially crafted MMS message. However, in the update itself, a vulnerability was also found (CVE-2015-3864), allowing attackers to exploit the device as in the case of Stagefright. A new update fixes this vulnerability.
')


It can be seen that most of the fixed vulnerabilities are of the Elevation of Privilege type and allow attackers to locally obtain high rights in the system to perform various system operations. Most of these vulnerabilities are located in the system components, which have high rights for their work, which is used by the attackers.

Only one vulnerability is related to the Remote Code Execution (RCE) type and allows attackers to remotely execute code on the device using specially crafted content. Such content can be delivered via MMS, or be a multimedia file for playback. Since the vulnerable component Mediaserver itself is a direct part of the OS and works with elevated privileges in the system, the attackers also upgrade them for their code during operation.

Earlier, Samsung also promised to regularly and regularly update its flagship smartphone models running Android.


be secure.