CVE-2015-5237

CWE-787 — Out-of-bounds Write CWE-190 — Integer Overflow CWE-131 CWE-122 — Heap-based Buffer Overflow9 documents7 sources

Severity

8.8HIGH

EPSS

0.8%

top 26.63%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Github.com Protocolbuffers/protobuf Google Protobuf

Timeline

PublishedSep 25

Latest updateDec 8

Description

protobuf allows remote authenticated attackers to cause a heap-based buffer overflow.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages7 packages

▶Gogithub.com/protocolbuffers/protobuf< 3.4.0

▶PyPIprotobuf< 3.4.0

▶NuGetGoogle.Protobuf< 3.4.0

▶Packagistgoogle/protobuf< 3.4.0

▶Mavencom.google.protobuf:protobuf-parent< 3.4.0

🔴Vulnerability Details

OSV

protobuf vulnerabilities↗2022-12-08

▶

OSV

protobuf susceptible to buffer overflow↗2022-05-13

▶

OSV

CVE-2015-5237: protobuf allows remote authenticated attackers to cause a heap-based buffer overflow↗2017-09-25

▶

CVEList

CVE-2015-5237: protobuf allows remote authenticated attackers to cause a heap-based buffer overflow↗2017-09-25

▶

📋Vendor Advisories

Ubuntu

protobuf vulnerabilities↗2022-12-08

▶

Red Hat

protobuf: integer overflow in serialization↗2015-08-27

▶

Debian

CVE-2015-5237: protobuf - protobuf allows remote authenticated attackers to cause a heap-based buffer over...↗2015

▶

💬Community

Bugzilla

CVE-2015-5237 protobuf: integer overflow in serialization↗2015-08-24

▶