Описание
A flaw was found in Glib's content type parsing logic. This buffer underflow vulnerability occurs because the length of a header line is stored in a signed integer, which can lead to integer wraparound for very large inputs. This results in pointer underflow and out-of-bounds memory access. Exploitation requires a local user to install or process a specially crafted treemagic file, which can lead to local denial of service or application instability.
Отчет
This vulnerability is rated Low for Red Hat. Exploitation requires a local user to install or process a specially crafted treemagic file, which limits the practical impact to local denial of service or application instability. Red Hat products are affected where GLib is used to process untrusted treemagic files.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | bootc | Fix deferred | ||
| Red Hat Enterprise Linux 10 | glib2 | Fix deferred | ||
| Red Hat Enterprise Linux 10 | glycin-loaders | Fix deferred | ||
| Red Hat Enterprise Linux 10 | loupe | Fix deferred | ||
| Red Hat Enterprise Linux 10 | mingw-glib2 | Fix deferred | ||
| Red Hat Enterprise Linux 10 | papers | Fix deferred | ||
| Red Hat Enterprise Linux 10 | rpm-ostree | Fix deferred | ||
| Red Hat Enterprise Linux 6 | glib2 | Fix deferred | ||
| Red Hat Enterprise Linux 7 | glib2 | Fix deferred | ||
| Red Hat Enterprise Linux 8 | glib2 | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
2.8 Low
CVSS3
Связанные уязвимости
A flaw was found in Glib's content type parsing logic. This buffer underflow vulnerability occurs because the length of a header line is stored in a signed integer, which can lead to integer wraparound for very large inputs. This results in pointer underflow and out-of-bounds memory access. Exploitation requires a local user to install or process a specially crafted treemagic file, which can lead to local denial of service or application instability.
A flaw was found in Glib's content type parsing logic. This buffer underflow vulnerability occurs because the length of a header line is stored in a signed integer, which can lead to integer wraparound for very large inputs. This results in pointer underflow and out-of-bounds memory access. Exploitation requires a local user to install or process a specially crafted treemagic file, which can lead to local denial of service or application instability.
A flaw was found in Glib's content type parsing logic. This buffer und ...
A flaw was found in Glib's content type parsing logic. This buffer underflow vulnerability occurs because the length of a header line is stored in a signed integer, which can lead to integer wraparound for very large inputs. This results in pointer underflow and out-of-bounds memory access. Exploitation requires a local user to install or process a specially crafted treemagic file, which can lead to local denial of service or application instability.
EPSS
2.8 Low
CVSS3