CVE-2015-2000

CRITICAL 9.8CVE-2015-2000 · Published 29/03/2018 · updated 17/06/2026

In short

CVE-2015-2000 is a CRITICAL (CVSS 9.8) vulnerability affecting jumio sdk (jumio).
Chance of exploitation in the next 30 days (EPSS): 2.0%, higher than 80.7% of all vulnerabilities.
Fix: update to 1.5.0 or later.

Package	Affected versions	Patched versions
jumio sdk jumio	`< 1.5.0`	`1.5.0`

Description

The Jumio SDK before 1.5.0 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function.

References

alephsecurity.com/vulns/aleph-2015001 · Third Party Advisory
usenix.org/system/files/conference/woot15/woot15-paper-peles.pdf · Technical Description

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free