Security update for protobuf

🗓️ 05 Sep 2025 12:17:44Reported by SuseType

suse🔗 www.suse.com👁 3 Views

Security update for protobuf fixes CVEs: JSON use-after-free, stack overflow, RecursionError.

Reporter	Title	Published	Views	Family All 804
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Application Performance Management	9 Jan 202510:41	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Edge Application Manager	20 Aug 202503:21	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Guardium Data Security Center is affected by multiple vulnerabilities	19 Jun 202505:35	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM® Db2® affect IBM® Db2® Big SQL	23 Jan 202610:25	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for February 2025.	12 Mar 202511:26	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security vulnerabilities affecting IBM Knowledge Catalog Premium Cartridge	7 Apr 202620:13	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses protobuf-4.21.12-cp37-abi3-manylinux2014_x86_64.whl and protobuf-4.25.7-cp37-abi3-manylinux2014_x86_64.whl which is vulnerable to CVE-2025-4565	29 May 202608:56	–	ibm
IBM Security Bulletins	Security Bulletin: There is a Denial of Service vulnerability in IBM WebSphere Liberty that is shipped with IBM CICS TX Advanced (CVE-2024-7254).	28 Jan 202522:08	–	ibm
IBM Security Bulletins	Security Bulletin: Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit, affect watsonx.data	30 Jun 202510:31	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in com.google.protobuf_protobuf-java affects IBM Db2 Data Management Console (CVE-2024-7254)	23 Jul 202520:15	–	ibm

OS	OS Version	Architecture	Package	Package Version	Filename
suse	6.1	aarch64	libprotobuf23_4_0	23.4	libprotobuf23_4_0-23.4-slfo.1.1_2.1.aarch64.rpm
suse	6.1	aarch64	libprotobuf23_4_0-debuginfo	23.4	libprotobuf23_4_0-debuginfo-23.4-slfo.1.1_2.1.aarch64.rpm
suse	6.1	aarch64	protobuf-debugsource	23.4	protobuf-debugsource-23.4-slfo.1.1_2.1.aarch64.rpm
suse	6.1	ppc64le	libprotobuf23_4_0	23.4	libprotobuf23_4_0-23.4-slfo.1.1_2.1.ppc64le.rpm
suse	6.1	ppc64le	libprotobuf23_4_0-debuginfo	23.4	libprotobuf23_4_0-debuginfo-23.4-slfo.1.1_2.1.ppc64le.rpm
suse	6.1	ppc64le	protobuf-debugsource	23.4	protobuf-debugsource-23.4-slfo.1.1_2.1.ppc64le.rpm
suse	6.1	s390x	libprotobuf23_4_0	23.4	libprotobuf23_4_0-23.4-slfo.1.1_2.1.s390x.rpm
suse	6.1	s390x	libprotobuf23_4_0-debuginfo	23.4	libprotobuf23_4_0-debuginfo-23.4-slfo.1.1_2.1.s390x.rpm
suse	6.1	s390x	protobuf-debugsource	23.4	protobuf-debugsource-23.4-slfo.1.1_2.1.s390x.rpm
suse	6.1	x86_64	libprotobuf23_4_0	23.4	libprotobuf23_4_0-23.4-slfo.1.1_2.1.x86_64.rpm

Source	Link
bugzilla	www.bugzilla.suse.com/show_bug.cgi
bugzilla	www.bugzilla.suse.com/show_bug.cgi
bugzilla	www.bugzilla.suse.com/show_bug.cgi
suse	www.suse.com/security/cve/CVE-2024-2410.html
suse	www.suse.com/security/cve/CVE-2024-7254.html
suse	www.suse.com/security/cve/CVE-2025-4565.html
suse	www.suse.com/security/cve/CVE-2024-2410.html
suse	www.suse.com/security/cve/CVE-2024-7254.html
suse	www.suse.com/security/cve/CVE-2025-4565.html
bugzilla	www.bugzilla.suse.com/show_bug.cgi

05 Sep 2025 12:17Current

7.8High risk

Vulners AI Score7.8

CVSS 3.17.6

CVSS 48.2

EPSS0.02772

protobuf vulnerability json parsing use after free stack overflow recursion error