Junglewise Threat Intelligence

CVE-2015-5237: Google Protobuf heap buffer overflow

CVE-2015-5237 · Severity: high · CVSS 8.8 · Published 2022-05-13

Technologies: Google Protobuf. Vendors: Google, Maven, PyPI, Go.

Executive brief

Google Protobuf, a widely used library for serializing structured data, is vulnerable to a memory corruption issue. An authenticated attacker could exploit this flaw to cause a system crash or potentially execute unauthorized commands. This could lead to service outages or the compromise of sensitive data in applications that rely on this library.

Technical details

A heap-based buffer overflow vulnerability (CWE-787) exists in Google Protobuf versions prior to 3.4.0. The flaw allows a remote authenticated attacker to trigger an out-of-bounds write by sending crafted input to an application utilizing the library. This can result in a denial-of-service (DoS) condition or potentially arbitrary code execution on the host system. The vulnerability affects multiple language implementations including C++, Java, Python, and Go. Users are advised to upgrade to version 3.4.0 or later to remediate the issue.

Affected products

  • Google Google.Protobuf < 3.4.0
  • Google protobuf < 3.4.0

Timeline

  • 2015-08-27: disclosed: Initial public disclosure via oss-security mailing list
  • 2017-08-15: patched: Version 3.4.0 released fixing the issue
  • 2022-05-13: advisory: GitHub Advisory published

References

Related threats