CVE-2020-5235
Summary
| CVE | CVE-2020-5235 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2020-02-04 03:15:00 UTC |
|---|
| Updated | 2020-02-06 18:51:00 UTC |
|---|
| Description | There is a potentially exploitable out of memory condition In Nanopb before 0.4.1, 0.3.9.5, and 0.2.9.4. When nanopb is compiled with PB_ENABLE_MALLOC, the message to be decoded contains a repeated string, bytes or message field and realloc() runs out of memory when expanding the array nanopb can end up calling `free()` on a pointer value that comes from uninitialized memory. Depending on platform this can result in a crash or further memory corruption, which may be exploitable in some cases. This problem is fixed in nanopb-0.4.1, nanopb-0.3.9.5, nanopb-0.2.9.4. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| Fix invalid free() after failed realloc() (GHSA-gcx3-7m76-287p) · nanopb/nanopb@7b39682 · GitHub |
MISC |
github.com |
Patch, Third Party Advisory |
| Out-of-memory condition on repeated field can result in invalid free() · Advisory · nanopb/nanopb · GitHub |
CONFIRM |
github.com |
Patch, Third Party Advisory |
| Fix invalid free() after failed realloc() (GHSA-gcx3-7m76-287p) · nanopb/nanopb@45582f1 · GitHub |
MISC |
github.com |
Patch, Third Party Advisory |
| Fix invalid free() after failed realloc() (GHSA-gcx3-7m76-287p) · nanopb/nanopb@aa9d0d1 · GitHub |
MISC |
github.com |
Patch, Third Party Advisory |
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 610329 Google Pixel Android April 2021 Security Patch Missing
- 610347 Google Android May 2021 Security Patch Missing for Huawei EMUI
