PT-2015-3391 · Google+4 · Protobuf+4

Merlimat · Published 2015-08-27 · Updated 2024-01-12 · CVE-2015-5237

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions protobuf (affected versions not specified)

Description The issue is related to a heap-based buffer overflow that can be caused by remote authenticated attackers. It is associated with an error in handling an integer variable during the compilation of the protobuf library. This can potentially allow a remote attacker to execute arbitrary code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Buffer Overflow

Weakness Enumeration

CWE-787

CWE-119

Related Identifiers

ALT-PU-2017-2591

BDU:2021-00232

CVE-2015-5237

ECHO-1CA1-F94C-B75C

GHSA-JWVW-V7C5-M82H

PYSEC-2017-150

PYSEC-2017-65

USN-5769-1

Affected Products

Alt Linux

Astra Linux

Debian

Ubuntu

Protobuf

References · 86

• https://osv.dev/vulnerability/PYSEC-2017-65 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-5237 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-5237 · Security Note
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0907SE47 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5769-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-5237 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-5237 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-00232 · Security Note
• https://osv.dev/vulnerability/GHSA-jwvw-v7c5-m82h · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2015-5237 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-0630SE17MD · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2015-5237 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2017-150 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-5237 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5769-1 · Vendor Advisory