Ryan pointed out that Google just started announcing security updates for Nexus:
Android Security Updates: Nexus Security Bulletin (August 2015)
On August 5, 2015, we released an over-the-air (OTA) update for Nexus 4/5/6/7/9/10 and Nexus Player devices that includes several security fixes. The patches for these fixes have also been released to the Android Open Source Project (AOSP) source repository. These issues are categorized and provided in decreasing order of severity. We have also provided an assessment of each issue, given the information we have at the time of the publication of this bulletin.
Here are brief details on the 6 CVEs listed in this bulletin, see full announcement for full details:
CVE-2015-1538: Integer overflows during MP4 atom processing
ID: ANDROID-20139950
Versions: 5.1 and below
Severity: Critical
Partners notified: May 4, 2015 (Bulletin 2015-07)
Fixed in Nexus Build: 5.1.1 (LMY48I)
Credit: Joshua Drake
CVE-2015-1539: An integer underflow in ESDS processing
ID: ANDROID-20139950
Versions: 5.1 and below
Severity: Critical
Partners notified: May 4, 2015 (Bulletin 2015-07)
Fixed in Nexus Build: 5.1.1 (LMY48I)
Credit: Joshua Drake
CVE-2015-3824: Integer overflow in libstagefright when parsing the MPEG4 tx3g atom
ID: ANDROID-20923261
Versions: Android 5.1 and below
Severity: Critical
Partners notified: June 25th, 2015 (Bulletin 2015-09)
Fixed in Nexus Build: 5.1.1 (LMY48I)
Credit: Joshua Drake
CVE-2015-3827: Integer underflow in libstagefright when processing MPEG4 covr atoms
ID: ANDROID-20923261
Versions: Android 5.1 and below
Severity: Critical
Partners notified: June 25th, 2015 (Bulletin 2015-09)
Fixed in Nexus Build: 5.1.1 (LMY48I)
Credit: Joshua Drake
CVE-2015-3828: Integer underflow in libstagefright if size is below 6 while processing 3GPP metadata
ID: ANDROID-20923261
Versions: Android 5.0 and above
Severity: Critical
Partners notified: June 25th, 2015 (Bulletin 2015-09)
Fixed in Nexus Build: 5.1.1 (LMY48I)
Credit: Joshua Drake
CVE-2015-3829: Integer overflow in libstagefright processing MPEG4 covr atoms when chunk_data_size is SIZE_MAX
ID: ANDROID-20923261
Versions: Android 5.1 and below
Severity: Critical
Partners notified: June 25th, 2015 (Bulletin 2015-09)
Fixed in Nexus Build: 5.1.1 (LMY48I)
Credit: not listed
Full announcement:
https://groups.google.com/forum/#!topic/android-security-updates/Ugvu3fi6RQM
https://source.android.com/devices/tech/security/overview/updates-resources.html
Firmware Security 