Описание
A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn’t. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corruption.
Отчет
The Red Hat Product Security team has assessed the severity of this vulnerability as Low, based on the high complexity required to trigger it and the limited impact. Exploitation requires unusually large string allocations, which are typically restricted in real-world deployments. However, under specific conditions where untrusted input is appended to a GString without size checks, a remote attacker could cause a crash or memory corruption, resulting in a denial of service (DoS) for the affected application.
Меры по смягчению последствий
Currently, no mitigation is available for this vulnerability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | bootc | Not affected | ||
| Red Hat Enterprise Linux 10 | glib2 | Fix deferred | ||
| Red Hat Enterprise Linux 10 | glycin-loaders | Not affected | ||
| Red Hat Enterprise Linux 10 | loupe | Not affected | ||
| Red Hat Enterprise Linux 10 | mingw-glib2 | Fix deferred | ||
| Red Hat Enterprise Linux 10 | rpm-ostree | Not affected | ||
| Red Hat Enterprise Linux 6 | glib2 | Not affected | ||
| Red Hat Enterprise Linux 7 | glib2 | Not affected | ||
| Red Hat Enterprise Linux 8 | glib2 | Not affected | ||
| Red Hat Enterprise Linux 8 | librsvg2 | Not affected |
Показывать по
Дополнительная информация
Статус:
3.7 Low
CVSS3
Связанные уязвимости
A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn’t. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corruption.
A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn’t. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corruption.
A flaw was found in how GLib\u2019s GString manages memory when adding ...
A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn’t. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corruption.
3.7 Low
CVSS3