Stagefright is the name of the native module in charge of playing media (and by the way that's an awesome name).

Since it is deeply embedded in the system, it is not possible to just push a Play Services update in order to update it.

These past months, several vulnerabilities have been revealed in that module. They allow privilege escalation & remote code execution.

The Nexus line (directly handled by Google) now receives very frequent security updates. Now, all the OEMs need to follow suit and also publish these updates for their own terminals.

Some bugs get names and logos now:

https://en.wikipedia.org/wiki/Stagefright_%28bug%29

I think GP means bugs in things like system libraries, where you expect the OS vendor to be making the fix.

A Text message exploit affecting most Android based phones (http://www.androidcentral.com/stagefright)