Google releases security patches for Nexus devices

Google’s monthly patch round for Nexus devices closes major flaws that allow remote execution of malicious code. Of the seven patches, five follow on from the infamous Stagefright bug.

This makes it Google’s fourth monthly patch for its Nexus devices. The company promised to improve the patch rollout after the first Stagefright bug and would offer monthly patches. Of the seven squashed bugs, two are ‘critical’, four ‘high’ and one ‘moderate’. The bugs have CVE codes CVE-2015-6608 through -6615. With that, libstagefright now also has a resume number: CVE-2015-6610. That libstagefright didn’t yet have its own resume number surprised Zimperium, the discoverer of the Stagefright bug, when several other bugs were discovered in October.

The Nexus devices that should get an ota sometime in the coming days include the Nexus 4, 5, 5X, 6, 6P, 7, 9, and 10. The entire list can be found on the Google developer blog, along with instructions to flash a device.

One of the main issues addressed is the “vulnerability to remote code execution using methods such as email, browsing and MMS when accessing media files,” Google wrote in the Groups forum.