PT-2012-2257 · Gnome+1 · Glib+1
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
GLib versions 2.31.8 and earlier
Description
The issue allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table, because the
g str hash function computes hash values without restricting the ability to trigger hash collisions predictably. Note that the existence of the g str hash function is not considered a vulnerability in the library, as callers of g hash table new and g hash table new full can specify an arbitrary hash function that is appropriate for the application.Recommendations
For GLib versions 2.31.8 and earlier, consider specifying an arbitrary hash function that is appropriate for the application when using
g hash table new and g hash table new full to minimize the risk of exploitation. As a temporary workaround, consider restricting the input to applications that maintain hash tables until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.DoS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Debian
Glib