Skip to content

Commit e7a3e78

Browse files
committed
Update Readme.md
1 parent 41c2117 commit e7a3e78

File tree

1 file changed

+2
-0
lines changed

1 file changed

+2
-0
lines changed

Readme.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,8 @@ A list of current bug checks:
3434
- [Stagefright - CVE-2015-6602](https://blog.zimperium.com/zimperium-zlabs-is-raising-the-volume-new-vulnerability-processing-mp3mp4-media/)
3535
- [Samsung Remote Code Execution as System] (https://code.google.com/p/google-security-research/issues/detail?id=489)
3636
- [CVE-2015-6608](https://groups.google.com/forum/#!topic/android-security-updates/GwZn7sixask)
37+
- [CVE-2015-7414](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1474)
38+
- [CVE-2015-1528](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1528)
3739

3840
## Previous work
3941
There have been attempts before to solve this issue. [xray.io](http://www.xray.io/) Xray works by actually attempting the exploit which doesn't satisfy our system stability constraint. There also exist other applications which attempt to determine a devices attack surface by simply using a lookup based on Android verison/build information. This causes both false negatives and false positives. Imagine the case where an OEM has back ported a fix to a device, but the check solely relies on an Android device; false positive. The case where an OEM upgrades to an Android version/kernel version which includes patches, but manages to break them causes the case of a false negative.

0 commit comments

Comments
 (0)