USN-7435-1: Protocol Buffers vulnerability

Reference Links

• https://ubuntu.com/security/CVE-2024-7254
• https://launchpad.net/ubuntu/+source/protobuf/3.21.12-9ubuntu1.1
• https://launchpad.net/ubuntu/+source/protobuf/3.21.12-8.2ubuntu0.1
• https://launchpad.net/ubuntu/+source/protobuf/3.12.4-1ubuntu7.22.04.2
• https://ubuntu.com/security/notices/USN-7435-1 (Advisory)

Child vulnerabilities

(Contains the following vulnerabilities)

• CVE-2024-7254

Frequently Asked Questions

• What is the severity of USN-7435-1?

  The severity of USN-7435-1 is rated as high due to the potential for denial of service.

• How do I fix USN-7435-1?

  To fix USN-7435-1, you should upgrade the libprotobuf-java package to version 3.21.12-9ubuntu1.1 or later, depending on your Ubuntu version.

• What versions of Ubuntu are affected by USN-7435-1?

  The affected versions of Ubuntu include 24.10, 24.04, and 22.04 with specific libprotobuf-java package versions.

• What is the nature of the vulnerability in USN-7435-1?

  The vulnerability in USN-7435-1 involves incorrect memory handling in Protocol Buffers when processing malicious input using Java bindings.

• Can USN-7435-1 lead to data compromise?

  While USN-7435-1 primarily leads to denial of service, it does not directly indicate potential data compromise.