Read the docs
TI-2015-05573 Aliases CVE-2015-6644GHSA-x38m-968w-w2xq

Bouncy Castle in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers…

Priority LOW 18CWE-200Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Partial Red Hat: 7 fixed, 2 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-200.

Summary

Bouncy Castle in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to obtain sensitive information via a crafted application, aka internal bug 24106146.

Why it matters now

EPSS 0.00934 60th percentileScored 2026-11-07
Fix Partial Red Hat: 6 advisoriesRed Hat: 7 fixed, 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*4.4.4VulnerableGoogle
cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*5.0VulnerableGoogle
cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*5.0.1VulnerableGoogle
cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*5.0.2VulnerableGoogle
cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*5.1.0VulnerableGoogle
cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*5.1.1VulnerableGoogle
cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*6.0VulnerableGoogle
cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*6.0.1VulnerableGoogle
  • cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:* Versions 4.4.4 Vulnerable ·Google
  • cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Google
  • cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:* Versions 5.0.1 Vulnerable ·Google
  • cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:* Versions 5.0.2 Vulnerable ·Google
  • cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:* Versions 5.1.0 Vulnerable ·Google
  • cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:* Versions 5.1.1 Vulnerable ·Google
  • cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Google
  • cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:* Versions 6.0.1 Vulnerable ·Google

Remediation

Red Hat 6 advisories

  • RHSA-2018:2927 Released 2018-10-16 · Red Hat rating Important
    Satellite 6.4 security, bug fix, and enhancement update
    • Red Hat Satellite 6.4 SOAPpy-0.11.6-17.el7, ansiblerole-insights-client-1.5-1.el7sat, candlepin-2.4.8-1.el7 +47
    • Red Hat Satellite Capsule 6.4 SOAPpy-0.11.6-17.el7, ansiblerole-insights-client-1.5-1.el7sat, createrepo_c-0.7.4-1.el7sat +47
  • RHSA-2017:2811 Released 2017-09-26 · Red Hat rating Important
    eap7-jboss-ec2-eap security update
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server eap7-jboss-ec2-eap-7.0.8-1.GA_redhat_1.ep7.el6, eap7-jboss-ec2-eap-samples-7.0.8-1.GA_redhat_1.ep7.el6
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server eap7-jboss-ec2-eap-7.0.8-1.GA_redhat_1.ep7.el7, eap7-jboss-ec2-eap-samples-7.0.8-1.GA_redhat_1.ep7.el7
  • RHSA-2017:2809 Released 2017-09-26 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform security update
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server eap7-artemis-native-1.1.0-13.redhat_4.ep7.el6, eap7-artemis-native-wildfly-1.1.0-13.redhat_4.ep7.el6, eap7-bouncycastle-1.56.0-3.redhat_2.2.ep7.el6 +31
Show 3 more Red Hat advisories
  • RHSA-2017:2808 Released 2017-09-26 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform security update
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server eap7-artemis-native-1.1.0-13.redhat_4.ep7.el7, eap7-artemis-native-wildfly-1.1.0-13.redhat_4.ep7.el7, eap7-bouncycastle-1.56.0-3.redhat_2.2.ep7.el7 +31
  • RHSA-2017:2810 Released 2017-09-26 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform security update
    • Red Hat JBoss EAP 7.0
  • RHSA-2017:1832 Released 2017-08-10 · Red Hat rating Important
    Red Hat JBoss Fuse/A-MQ 6.3 R4 security and bug fix update
    • Red Hat JBoss A-MQ 6.3
    • Red Hat JBoss Fuse 6.3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss A-MQ 6AffectedNo fix yet
Red Hat Subscription Asset ManagerAffectedNo fix planned: Will not fix
Red Hat JBoss A-MQ 6.3Fixed RHSA-2017:1832
Red Hat JBoss EAP 7.0Fixed RHSA-2017:2810
Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 ServerFixed RHSA-2017:2809, RHSA-2017:2811
Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 ServerFixed RHSA-2017:2808, RHSA-2017:2811
Red Hat JBoss Fuse 6.3Fixed RHSA-2017:1832
Red Hat Satellite 6.4Fixed RHSA-2018:2927
Red Hat Satellite Capsule 6.4Fixed RHSA-2018:2927

Timeline

  1. 2026-10-02 Threatist record created from CVE-2015-6644
  2. 2026-10-03 Alias added: GHSA-x38m-968w-w2xq
  3. 2026-11-06 Fix available: Red Hat JBoss EAP 7.0 · Red Hat

References

Advisory 9

  • TI-2026-42236 Improper authorization in Google Android KEVCVSS 3.1HIGH 8.8
  • TI-2025-30821 Use after free in Google Android KEVCVSS 3.1HIGH 8.8
  • TI-2023-17777 Improper privilege management in Google Android KEVCVSS 3.1HIGH 8.8
  • TI-2025-30872 Integer overflow in Google Android KEVCVSS 3.1HIGH 8.4
  • TI-2024-21766 there is a possible way to bypass due to a logic error in the code. KEVCVSS 3.1HIGH 8.1
  • TI-2025-30849 Missing authentication in Google Android KEVCVSS 3.1HIGH 7.8
See all 8410 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences