PT-2009-6742 · Gnome+1 · Libglib-2 0-0+8
Diego Petteno
·
Published
1970-01-01
·
Updated
2023-02-13
·
CVE-2008-4316
CVSS v2.0
4.6
Medium
| Vector | AV:L/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
GLib versions prior to 2.20
glib2-devel versions prior to 2.12.3
glib2-debuginfo versions prior to 2.12.3
libgio-2 0-0 versions prior to 2.20
libgmodule-2 0-0 versions prior to 2.20
libgobject-2 0-0 versions prior to 2.20
libgthread-2 0-0 versions prior to 2.20
libglib-2 0-0 versions prior to 2.20
Description
The issue is related to multiple integer overflows in the glib/gbase64.c file of GLib, which can be exploited by context-dependent attackers to execute arbitrary code via a long string that is converted either from or to a base64 representation. The vulnerability can lead to a disruption of confidentiality, integrity, and availability of protected information. It can be exploited locally.
Recommendations
For GLib versions prior to 2.20, update to version 2.20 or later.
For glib2-devel versions prior to 2.12.3, update to version 2.12.3 or later.
For glib2-debuginfo versions prior to 2.12.3, update to version 2.12.3 or later.
For libgio-2 0-0 versions prior to 2.20, update to version 2.20 or later.
For libgmodule-2 0-0 versions prior to 2.20, update to version 2.20 or later.
For libgobject-2 0-0 versions prior to 2.20, update to version 2.20 or later.
For libgthread-2 0-0 versions prior to 2.20, update to version 2.20 or later.
For libglib-2 0-0 versions prior to 2.20, update to version 2.20 or later.
As a temporary workaround, consider disabling the base64 conversion functions until a patch is available.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Glib
Red Hat
Glib2-Debuginfo
Glib2-Devel
Libgio-2 0-0
Libglib-2 0-0
Libgmodule-2 0-0
Libgobject-2 0-0
Libgthread-2 0-0