CVE-2015-5237: Buffer Overflow
Google Protocol Buffers could allow a remote attacker to execute arbitrary code on the system, caused by an integer overflow in MessageLite::SerializeToString. A remote attacker could exploit this vulnerability to execute arbitrary code on the vulnerable system or cause a denial of service.
Other sources
It was discovered that the protobuf library and code generated by the protobuf compiler store size information in an int variable, which may truncate size values on 64-bit architectures, leading to a heap-based buffer overflow.
Acknowledgements:
This issue was discovered by Florian Weimer of Red Hat Product Security.
— Red Hat
protobuf allows remote authenticated attackers to cause a heap-based buffer overflow.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2015-5237.
What is the severity of CVE-2015-5237?
The severity of CVE-2015-5237 is high.
What is the affected software for CVE-2015-5237?
The affected software for CVE-2015-5237 includes Google Protobuf, IBM EWM 7.0.1, IBM RTC 6.0.6.1, IBM DOORS Next 7.0.2, IBM RDNG 6.0.6.1, IBM Engineering Requirements Quality Assistant On-Premises, IBM RELM 6.0.6.1, IBM ENI 7.0.1, IBM RQM 6.0.6.1, IBM ETM 7.0.1, IBM CLM 6.0.6.1, and IBM ELM 7.0.
How can a remote attacker exploit CVE-2015-5237?
A remote attacker can exploit CVE-2015-5237 by causing a heap-based buffer overflow using an integer overflow in MessageLite::SerializeToString.
Are there any references for CVE-2015-5237?
Yes, the references for CVE-2015-5237 include: [GitHub](https://github.com/google/protobuf/issues/760), [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=1256426), and [IBM X-Force](https://exchange.xforce.ibmcloud.com/vulnerabilities/105989).