Summary
USN-7435-1 and USN-7629-1 fixed vulnerabilities in Protocol Buffers
for several releases of Ubuntu. This update provides the corresponding
fixes for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
Original advisory details:
It was discovered that Protocol Buffers incorrectly handled memory when
receiving malicious input using the Python bindings. An attacker could
possibly use this issue to cause a denial of service. (CVE-2025-4565)
It was discovered that Protocol Buffers incorrectly handled memory when
receiving malicious input using the Java bindings. An attacker could
possibly use this issue to cause a denial of service. This issue only
affected Ubuntu 25.04. (CVE-2024-7254)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | protobuf | 2.6.1-1.3ubuntu0.1~esm4 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | protobuf | 3.0.0-9.1ubuntu1.1+esm3 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | protobuf | 3.6.1.3-2ubuntu5.2+esm2 |
Vulnerabilities 2
-
High 8.7
Stack overflow in Protocol Buffers Java Lite
Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsPar…
-
High 8.2
Unbounded recursion in Python Protobuf
Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. This can re…