Summary
It was discovered that Nanopb incorrectly handled certain decode messages.
An attacker could possibly use this cause a denial of service or expose
sensitive information. (CVE-2020-26243)
It was discovered that Nanopb incorrectly handled certain decode messages.
An attacker could possibly use this issue to cause a denial of service
or execute arbitrary code. (CVE-2021-21401)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | nanopb | 0.4.1-1ubuntu0.1~esm1 |
Vulnerabilities 2
-
High 7.5
Memory leak in nanopb
Nanopb is a small code-size Protocol Buffers implementation. In Nanopb before versions 0.4.4 and 0.3.9.7, decoding specifically formed message can leak memory if dynamic allocation is enabled and an oneof field contains a static submessage that contains a dyn…
-
High 7.1CVE-2021-21401 Public exploit
Invalid free() call in Nanopb
Nanopb is a small code-size Protocol Buffers implementation in ansi C. In Nanopb before versions 0.3.9.8 and 0.4.5, decoding a specifically formed message can cause invalid `free()` or `realloc()` calls if the message type contains an `oneof` field, and the `…