[CVE-2016-3861] Return to libstagefright: exploiting libutils on Android

Disclosure of multiple internet-to-baseband remote code execution vulnerabilities affecting Samsung Exynos modems, detailing the flaws, affected devices, and patch availability.

This post is the second of a multi-part series capturing my journey from discovering a vulnerable little-known Samsung image codec, to completing a remote zero-click MMS attack that worked on the latest Samsung flagship devices. New posts will be published as they are completed and will be linked here when complete.

A guest post describing CVE-2017-7308, a signedness bug in Linux packet sockets leading to a heap out-of-bounds write and local privilege escalation, found via syzkaller.

Amid confusion over the remote exploitability of Android libstagefright vulnerabilities, this post demonstrates a working exploit for one of them on recent Android versions, Android 5.0+ on Nexus 5.

Dynamic Open Graph image generation is common in Next.js apps; any route accepting user parameters to customize SVG cards could lead to full Node.js server compromise.

libheif is a core dependency for HEIF and AVIF image decoding across servers and desktop utilities; services that accept user-uploaded images and transcode them are susceptible to remote crashes and heap exploitation.