CVE-2015-2004

CRITICAL 9.8CVE-2015-2004 · Published 29/03/2018 · updated 17/06/2026

In short

CVE-2015-2004 is a CRITICAL (CVSS 9.8) vulnerability affecting gnsdk (gracenote).
Chance of exploitation in the next 30 days (EPSS): 2.0%, higher than 80.7% of all vulnerabilities.
Fix: update to 1.1.7 or later.

Package	Affected versions	Patched versions
gnsdk gracenote	`< 1.1.7`	`1.1.7`

Description

The GraceNote GNSDK SDK before SVN Changeset 1.1.7 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function.

References

alephsecurity.com/vulns/aleph-2015005 · Third Party Advisory
usenix.org/system/files/conference/woot15/woot15-paper-peles.pdf · Technical Description

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free