USN-5769-1

Source

https://ubuntu.com/security/notices/USN-5769-1

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/USN-5769-1.json

Related

CVE-2015-5237
CVE-2022-1941

Published

2022-12-08T17:57:48.029885Z

Modified

2022-12-08T17:57:48.029885Z

Details

It was discovered that protobuf did not properly manage memory when serializing large messages. An attacker could possibly use this issue to cause applications using protobuf to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2015-5237)

It was discovered that protobuf did not properly manage memory when parsing specifically crafted messages. An attacker could possibly use this issue to cause applications using protobuf to crash, resulting in a denial of service. (CVE-2022-1941)

References

Affected packages

Ubuntu:Pro:16.04:LTS / protobuf

Package

Name: protobuf

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0The exact introduced commit is unknown

Fixed

2.6.1-1.3ubuntu0.1~esm2

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "binaries": [
        {
            "libprotobuf-java": "2.6.1-1.3ubuntu0.1~esm2",
            "python-protobuf": "2.6.1-1.3ubuntu0.1~esm2",
            "libprotoc-dev": "2.6.1-1.3ubuntu0.1~esm2",
            "protobuf-compiler": "2.6.1-1.3ubuntu0.1~esm2",
            "libprotobuf-dev": "2.6.1-1.3ubuntu0.1~esm2",
            "libprotobuf-lite9v5": "2.6.1-1.3ubuntu0.1~esm2",
            "libprotoc9v5": "2.6.1-1.3ubuntu0.1~esm2",
            "libprotobuf9v5": "2.6.1-1.3ubuntu0.1~esm2"
        }
    ]
}