CVE-2014-125106

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Nanopb before 0.3.1 allows size_t overflows in pb_dec_bytes and pb_dec_string.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published
Jun 17, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2014

CVE-2014-1251075.3A vulnerability was found in Corveda PHPSandbox 1.3.4 and classified as critical. Affected by this issue is some unknown functionality of thCVE-2014-1251086.1A vulnerability was found in w3c online-spellchecker-py up to 20140130. It has been rated as problematic. This issue affects some unknown prCVE-2014-1251096.1A vulnerability was found in BestWebSoft Portfolio Plugin up to 2.27. It has been declared as problematic. This vulnerability affects the fuCVE-2014-1251103.5A vulnerability has been found in wp-file-upload Plugin up to 2.4.3 on WordPress and classified as problematic. Affected by this vulnerabiliCVE-2014-1251113.5A vulnerability was found in namithjawahar Wp-Insert up to 2.0.8 and classified as problematic. Affected by this issue is some unknown functCVE-2014-1251129.8Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code execution. Plack::Middleware::Session::Cookie versionsCVE-2014-1251139.3An unrestricted file upload vulnerability exists in Dell (acquired by Quest) KACE K1000 System Management Appliance version 5.0 - 5.3, 5.4 pCVE-2014-1251148.4A stack-based buffer overflow vulnerability exists in i-Ftp version 2.20 due to improper handling of the Time attribute within Schedule.xml.CVE-2014-12511510.0An unauthenticated SQL injection vulnerability exists in Pandora FMS version 5.0 SP2 and earlier. The mobile/index.php endpoint fails to proCVE-2014-1251169.3A remote code execution vulnerability exists in HybridAuth versions 2.0.9 through 2.2.2 due to insecure use of the install.php installation CVE-2014-1251179.8A stack-based buffer overflow vulnerability in the my_cgi.cgi component of certain D-Link devices, including the DSP-W215 version 1.02, can CVE-2014-1251189.4A command injection vulnerability exists in the eScan Web Management Console version 5.5-2. The application fails to properly sanitize the '
CVE-2014-125106: Critical severity, CVSS 9.8 | Vulnix