CVE-2020-5235

Source
https://nvd.nist.gov/vuln/detail/CVE-2020-5235
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-5235.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2020-5235
Related
Published
2020-02-04T03:15:10Z
Modified
2025-01-08T10:32:00.380248Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

There is a potentially exploitable out of memory condition In Nanopb before 0.4.1, 0.3.9.5, and 0.2.9.4. When nanopb is compiled with PBENABLEMALLOC, the message to be decoded contains a repeated string, bytes or message field and realloc() runs out of memory when expanding the array nanopb can end up calling free() on a pointer value that comes from uninitialized memory. Depending on platform this can result in a crash or further memory corruption, which may be exploitable in some cases. This problem is fixed in nanopb-0.4.1, nanopb-0.3.9.5, nanopb-0.2.9.4.

References

Affected packages

Git / github.com/nanopb/nanopb

Affected ranges

Type
GIT
Repo
https://github.com/nanopb/nanopb
Events

Affected versions

0.*

0.3.6
0.3.7
0.3.8
0.3.9
0.3.9.1
0.3.9.2
0.3.9.3
0.3.9.4
0.4.0

nanopb-0.*

nanopb-0.1.0
nanopb-0.1.1
nanopb-0.1.2
nanopb-0.1.3
nanopb-0.1.4
nanopb-0.1.5
nanopb-0.1.6
nanopb-0.1.7
nanopb-0.1.8
nanopb-0.1.9
nanopb-0.2.0
nanopb-0.2.1
nanopb-0.2.2
nanopb-0.2.3
nanopb-0.2.4
nanopb-0.2.5
nanopb-0.2.6
nanopb-0.2.7
nanopb-0.2.8
nanopb-0.2.9
nanopb-0.2.9.1
nanopb-0.2.9.2
nanopb-0.2.9.3
nanopb-0.3.0
nanopb-0.3.1
nanopb-0.3.2
nanopb-0.3.3
nanopb-0.3.4
nanopb-0.3.5
nanopb-0.3.6
nanopb-0.3.7
nanopb-0.3.8
nanopb-0.3.9
nanopb-0.3.9.1
nanopb-0.3.9.2
nanopb-0.3.9.3
nanopb-0.3.9.4
nanopb-0.4.0
nanopb-0.4.0-dev