GraceNote GNSDK
Before version 1.1.7
Use SVN Changeset 1.1.7 or later.
The GraceNote GNSDK SDK for Android contains a Serializable class, with a ‘finalize’ method that later calls a native function with an attacker-controllabe pointer, eventually allowing for code execution by malicious apps.