CyanogenMod updates to Android 5.1, includes Stagefright security fixes

Popular Android community operating system CyanogenMod has announced that it will be rolling out a revised version built for Android 5.1.1. Among the other key highlights of the build are support for IMAP Idle, the release of SDK v1 and also security bug fixes. Users who use bleeding edge CyanogenMod 11.0 and 12.0 nightlies don’t have to update to the new version. According to the official CyanogenMod blog, “We’re queuing up releases across three branches this evening, releasing into the wild CM 11.0-security, 12.0-security and our very first 12.1 release. As always, these releases are being marked as ‘known good’ by their maintainer, and signed-off individually. This means that not every CM device will receive a release – only those marked as ‘Good to go’ by the maintainer.” Since the updates are signed-off individually by the maintainers of the project, an update will be available only for those devices that have been marked good to go. CyanogenMod hasn’t released a list of these devices yet. The update adds, “The 11.0 and 12.0 builds are security releases built on top of the last CM11/12.0 releases, modified to include the recent security disclosures, including the vulnerabilities in Stagefright. Users of the previous 11/12.0 release builds are encouraged to update. Users of 11.0/12.0 weeklies (nightlies) will see no net change, and need not update.” The Stagefright vulnerability is said to be the **biggest Android security problem for years now** . The exploit leaves almost 95 percent of all Android users susceptible to attacks. The Stagefright bug lets attacker remotely execute code using multimedia text messages, and in most cases the users doen’t even see the message. The bug, named ‘Stagefright’, is actually a **media library that processes several popular media formats** . Since media processing is often time-sensitive, the library is implemented in native code (C++) that is more prone to memory corruption than memory-safe languages like Java.