CVE-2015-5237

mediumpriority · track · 37EPSS 0.050 · 92 %ileDEEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

4.96% (92nd) EPSS

CVSS 6.5 · medium

Is it mine?

16 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-22

protobuf allows remote authenticated attackers to cause a heap-based buffer overflow.

cvss

Technical severity, 0–10. One row per scoring source.

8.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.5–8.8

v2.06.5mediumAV:N/AC:L/Au:S/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 8 · impact 6.4

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 2.8 · impact 5.9

v3.18.8highAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · OSV

v3.18.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-787USprimaryCWE-119USCWE-787US

affected products (16)

Products and version ranges known to be affected.

IBM QRadar SIEMall versionscert_bundDEcpe:/a:ibm:qradar_siem:-
IBM QRadar SIEM <7.3.3 Patch 7all versionscert_bundDE
IBM QRadar SIEM <7.4.2 Patch 2all versionscert_bundDE
IBM QRadar SIEM< 7.3.3 Patch 7cert_bundDE
IBM QRadar SIEM< 7.4.2 Patch 2cert_bundDE
n/a n/a≤ n/aenisa_euvdEU
Google Inc Protobuf≤ 3.4.0fstec_bduRU
ООО «РусБИТех-Астра» Astra Linux Special Edition≤ 1.7fstec_bduRU
ООО «РусБИТех-Астра» Astra Linux Special Edition≤ 4.7fstec_bduRU
google protobuf≤ 3.1.0nvdUScpe:2.3:a:google:protobuf:*:*:*:*:*:*:*:*
Go github.com/protocolbuffers/protobuf< 3.4.0osvUSpkg:golang/github.com/protocolbuffers/protobuf
Maven com.google.protobuf:protobuf-parent< 3.4.0osvUSpkg:maven/com.google.protobuf/protobuf-parent
NuGet Google.Protobuf< 3.4.0osvUSpkg:nuget/Google.Protobuf
Packagist google/protobuf< 3.4.0osvUSpkg:composer/google/protobuf
PyPI protobuf< 3.1.0.post1osvUSpkg:pypi/protobuf
PyPI protobuf< 3.4.0osvUSpkg:pypi/protobuf

advisories (7)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2024-0049Splunk Enterprise: Mehrere SchwachstellenDeutsch2024-01-09csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Splunk Enterprise ausnutzen, um beliebigen Programmcode auszuführen, einen Denial of Service Zustand herbeizuführen oder unbekannte Auswirkungen zu verursachen.
WID-SEC-W-2024-0054IBM Security Verify Access: Mehrere SchwachstellenDeutsch2024-01-09csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in IBM Security Verify Access ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen, seine Privilegien zu erweitern oder komplexe Angriffe wie Cache Poisoning, Cross-Site-Scripting oder Session-Hijacking durchzuführen.
WID-SEC-W-2026-2751IBM InfoSphere Guardium: Mehrere SchwachstellenDeutsch2018-12-13csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM InfoSphere Guardium ausnutzen, um dadurch die Integrität, Vertraulichkeit und Verfügbarkeit zu gefährden.
WID-SEC-W-2026-3721IBM QRadar SIEM: Mehrere SchwachstellenDeutsch2021-05-04csaf · cert_bundDE
Ein entfernter, anonymer, authentifizierter, lokaler oder benachbarter Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM ausnutzen, um Informationen offenzulegen, Cross-Site-Scripting-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen, beliebigen Code auszuführen oder einen Denial of Service Zustand auszulösen.
GHSA-jwvw-v7c5-m82hprotobuf susceptible to buffer overflow2022-05-13ghsa · osvUS
protobuf allows remote authenticated attackers to cause a heap-based buffer overflow.
PYSEC-2017-1502017-09-25vendor · osvUS
Withdrawn as duplicate of PYSEC-2017-65 protobuf allows remote authenticated attackers to cause a heap-based buffer overflow.
PYSEC-2017-652017-09-25vendor · osvUS
protobuf allows remote authenticated attackers to cause a heap-based buffer overflow.

also known as (8)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv cert_bund nvd NVD CVE.org MITRE

published 2017-09-25modified 2026-06-17

related (16,026)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-86950US	—OT critical	1.24% (69th)	KEV	2026-09-28
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing…
CVE-2026-87491US	—OT critical	3.14% (88th)	KEV	2026-09-09
Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security…
CVE-2026-53362US	—OT critical	0.71% (53rd)	KEV	2026-07-04
In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branc…
CVE-2026-53266US	—OT critical	0.83% (57th)	KEV	2026-06-25
In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite writable The ebtables SNAT target keeps the Ethernet source addre…
CVE-2026-11645US	—OT critical	2.44% (84th)	KEV	2026-06-09
Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium…

+16021 more

references (139)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan