{"id":"UBUNTU-CVE-2015-3863","details":"Multiple integer overflows in the Blob class in keystore/keystore.cpp in Keystore in Android before 5.1.1 LMY48M allow attackers to execute arbitrary code and read arbitrary Keystore keys via an application that uses a crafted blob in an insert operation, aka internal bug 22802399.","modified":"2025-10-24T04:45:23Z","published":"2015-10-01T00:59:00Z","upstream":["CVE-2015-3863"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2015-3863"},{"type":"REPORT","url":"https://android.googlesource.com/platform/system/security/+/bb9f4392c2f1b11be3acdc1737828274ff1ec55b"},{"type":"REPORT","url":"https://groups.google.com/forum/#!topic/android-security-updates/iv1BF0f0XY4"},{"type":"REPORT","url":"https://android.googlesource.com/platform/system/security/+/0d5935262dbbcaf2cf6145529ffd71a728ef4609%5E!/#F0"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2015-3863"}],"affected":[{"package":{"name":"android","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/android@20160330-0939-0ubuntu1?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20150818-1500-0ubuntu2","20150818-1500-0ubuntu3","20160307-0742-0ubuntu3","20160330-0939-0ubuntu1"],"ecosystem_specific":{"binaries":[{"binary_version":"20160330-0939-0ubuntu1","binary_name":"android"},{"binary_name":"android-copyright","binary_version":"20160330-0939-0ubuntu1"},{"binary_name":"android-emulator","binary_version":"20160330-0939-0ubuntu1"},{"binary_name":"ubuntu-emulator-images","binary_version":"20160330-0939-0ubuntu1"},{"binary_name":"ubuntu-emulator-runtime","binary_version":"20160330-0939-0ubuntu1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2015/UBUNTU-CVE-2015-3863.json"}}],"schema_version":"1.7.3","severity":[{"type":"Ubuntu","score":"medium"}]}