CVE-2015-2001

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The MetaIO SDK before 6.0.2.1 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-118

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://alephsecurity.com/vulns/aleph-2015002Third Party Advisory
https://www.usenix.org/system/files/conference/woot15/woot15-paper-peles.pdfTechnical Description, Third Party Advisory
https://alephsecurity.com/vulns/aleph-2015002Third Party Advisory
https://www.usenix.org/system/files/conference/woot15/woot15-paper-peles.pdfTechnical Description, Third Party Advisory

Timeline

Published: Mar 29, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-200195.4The Content text slider on post WordPress plugin before 6.9 does not sanitise and escape the Title and Message/Content settings, which could CVE-2015-20029.8The ESRI ArcGis Runtime SDK before 10.2.6-2 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a CVE-2015-20039.8The PJSIP PJSUA2 SDK before SVN Changeset 51322 for Android might allow attackers to execute arbitrary code by leveraging a finalize method CVE-2015-20049.8The GraceNote GNSDK SDK before SVN Changeset 1.1.7 for Android might allow attackers to execute arbitrary code by leveraging a finalize meth CVE-2015-20055.3IBM Security QRadar SIEM 7.1.x before 7.1 MR2 Patch 12 and 7.2.x before 7.2.5 Patch 6 does not properly expire sessions, which allows remote CVE-2015-200677.5The WP Attachment Export WordPress plugin before 0.2.4 does not have proper access controls, allowing unauthenticated users to download the CVE-2015-20075.0Directory traversal vulnerability in IBM Security QRadar SIEM 7.2.x before 7.2.5 Patch 6 allows remote authenticated users to read arbitrary CVE-2015-20084.4IBM Security QRadar SIEM 7.1.x before 7.1 MR2 Patch 12 and 7.2.x before 7.2.6 includes SSH private keys during backup operations, which allo CVE-2015-20098.8Cross-site request forgery (CSRF) vulnerability in the xmlrpc.cgi service in IBM QRadar SIEM 7.1 before MR2 Patch 11 Interim Fix 02 and 7.2.CVE-2015-201059.6The ClickBank Affiliate Ads WordPress plugin through 1.20 does not have CSRF check when saving its settings, allowing attacker to make logge CVE-2015-201064.8The ClickBank Affiliate Ads WordPress plugin through 1.20 does not escape its settings, allowing high privilege users to perform Cross-Site CVE-2015-201077.6In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file.