CVE-2015-2310
CriticalSummary
Integer overflow in layout.c++ in Sandstorm Cap'n Proto before version 0.4.1.1 and 0.5.x before version 0.5.1.1 allows remote peers to cause a denial of service or possibly obtain sensitive information from memory via a crafted message, related to pointer validation.
Risk Assessment
Organizations may be exposed to denial of service and leakage of sensitive data, which can lead to serious information security consequences.
Recommendation
It is recommended to update Sandstorm Cap'n Proto to the latest version to mitigate this vulnerability and conduct a security audit of systems using this application.
Other vulnerabilities in Sandstorm Cap'n Proto
See all- CVE-2015-2313High
In Sandstorm Cap'n Proto versions before 0.4.1.1 and 0.5.x before 0.5.1.2, the totalSize method on an object reader can be exploited by remote peers to cause a denial of service through a crafted small message, leading to high CPU consumption.
- CVE-2015-2312High
Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 allows remote peers to cause a denial of service via a list with a large number of elements.
- CVE-2017-7892High
Sandstorm Cap'n Proto before 0.5.3.1 allows remote crashes related to a compiler optimization. A remote attacker can trigger a segfault in a 32-bit libcapnp application due to overflow in pointer arithmetic calculations.
- CVE-2015-2311Critical
An integer underflow in Sandstorm Cap'n Proto before version 0.4.1.1 and 0.5.x before 0.5.1.1 may allow remote peers to cause a denial of service or potentially obtain sensitive information from memory or execute arbitrary code via a crafted message.
Original NVD description (English source)
Integer overflow in layout.c++ in Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 allows remote peers to cause a denial of service or possibly obtain sensitive information from memory via a crafted message, related to pointer validation.