Описание
A flaw was found in the GNOME libgsf package, affecting the gsf_property_settings_collec function. Manipulation of the n_alloced_params argument can lead to a heap-based buffer overflow.
Отчет
This CVE has been marked as Rejected by the assigning CNA. The code maintainer explains that "[the] call is invalid [as] the buffer pointed to by "data" must have "len" valid bytes." The documentation was fixed to make that clear.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | libgsf | Fix deferred | ||
| Red Hat Enterprise Linux 6 | libgsf | Fix deferred | ||
| Red Hat Enterprise Linux 7 | libgsf | Fix deferred | ||
| Red Hat Enterprise Linux 8 | libgsf | Fix deferred | ||
| Red Hat Enterprise Linux 9 | libgsf | Fix deferred |
Показывать по
Дополнительная информация
5.3 Medium
CVSS3
Связанные уязвимости
Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The code maintainer explains that "[the] call is invalid [as] the buffer pointed to by "data" must have "len" valid bytes." The documentation was fixed to make that clear.
Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The code maintainer explains that "[the] call is invalid [as] the buffer pointed to by "data" must have "len" valid bytes." The documentation was fixed to make that clear.
A vulnerability was found in GNOME libgsf up to 1.14.53. It has been rated as critical. This issue affects the function gsf_property_settings_collec. The manipulation of the argument n_alloced_params leads to heap-based buffer overflow. Attacking locally is a requirement. The vendor was contacted early about this disclosure but did not respond in any way.
Уязвимость функции gsf_property_settings_collec библиотеки структурированных файлов The GNOME Project libgsf, позволяющая нарушителю выполнить произвольный код
5.3 Medium
CVSS3