Update 8: AT&T LG G4 (August 31, 2015)
Stagefright fix now finally rolling for the AT&T LG G4 as well, version H81010l
  Update 7: AT&T HTC One M8 and One M9 (August 25, 2015)
AT&T HTC One M8 and One M9 now receiving the Stagefright fix with software version 4.28.502.2 and 2.6.502.18, rsepectively.
  Update 6: AT&T Galaxy S3 (August 21, 2015)
AT&T Galaxy S3 Stagefright fix is also rolling out now with firmware build I747UCUFNJ2. Good to know that AT&T cares about security updates even for older devices.
Thanks M for letting us know. 
  Update 5 (August 13th, 2015):
AT&T Galaxy Note 3 and Galaxy Alpha now receiving OTA updates with “Device security improvements” (read: Stagefright fix), build numbers N900AUCUEOC2 and G850AUCU1BOC7, respectively.  
  Update 4 (August 13th, 2015):
AT&T Nexus 6 now receiving fix for Stagefright vulnerability, build LMY481.  
  Update 3 (August 11th, 2015):
AT&T Galaxy S4 and S4 Active Stagefright fix rolling out with build number I337UCUGOC4 and I537UCUCOC7, respectively.  
  Update 2 (August 10th, 2015):
AT&T Galaxy S6 and S6 edge also receiving Stagefright fix with build number G920AUCU2AOF3 and G925AUCU2AOF4, respectively. OTA Update size over 100MB.
  Update:
Seems like AT&T Galaxy S6 active Stagefright fix is rolling out as well, build G890AUCU2AOF4. Be sure to check for the OTA update manually from device settings. 

AT&T is pushing out a OTA update with “Device security improvements” to a number of Samsung Galaxy devices, we guess it’s related to the Stagefright vulnerability that being patched with these OTA updates. Earlier today Sprint rolled patch for the vulnerability for a number of Samsung devices as well.

However, the OTA updates AT&T is pushing out are pretty huge, about 200-300MB in size. So they might be packing some other security improvements as well, along with a patch for Stagefright. Or maybe, Stagefright needs such big change in the software.

For the unknown, Stagefright vulnerability allows an attacker to send media files through MMS to any Android device and target Android’s media playback engine, Stagefright, to steal important data, as well as hijacking the device’s microphone and camera. The vulnerability doesn’t even need you to open the MMS file, an attacker can compromise your device without you even knowing about it. This is really a serious security bug that all Android users should be worried about.

Below is the list of devices that received Stagefright fix from AT&T:

  • AT&T Galaxy S5 – build G900AUCU4BOF3
  • AT&T Galaxy S5 active – build G870AUCU2BOF3
  • AT&T Galaxy Note 4 – build N915AUCU2BOC8
  • AT&T Galaxy Note edge – build N910AUCU2COC6
  • AT&T Galaxy S6 Active – build G890AUCU2AOF4
  • AT&T Galaxy S6 – build G920AUCU2AOF3
  • AT&T Galaxy S6 edge – build G925AUCU2AOF4
  • AT&T Galaxy S4 – build I337UCUGOC4
  • AT&T Galaxy S4 Active – build I537UCUCOC7
  • AT&T Nexus 6 – build LMY481
  • AT&T Galaxy Note 3 – build, N900AUCUEOC2
  • AT&T Galaxy Alpha – build G850AUCU1BOC7
  • AT&T Galaxy S3 – build I747UCUFNJ2
  • AT&T HTC One M8 – version 4.28.502.2
  • AT&T HTC One M9 – version 2.6.502.18
  • AT&T LG G4 – version H81010l

The OTA updates are on the roll as we speak for all the devices mentioned above. If you haven’t received the update notification yet, just go to your device’ Settings > About > Software updates section and hit Check for updates button to get the update.