Описание
A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the g_date_time_get_ymd function in the glib/gdatetime.c file when an invalid GDateTime object produced by the g_date_time_add_full function is processed. This flaw can corrupt the date output and potentially cause logic errors that may lead to a denial of service.
Отчет
Any applications that allow a user to submit a date to g_date_time_add_full() and later call any getter functions, such as g_date_time_get_month() or g_date_time_get_year(), with the returned GDateTime object are vulnerable to this issue. This flaw can cause an out-of-bounds read of only 2 bytes, leading to a denial of service due to logic errors that a corrupted date can trigger. Due to these reasons, this vulnerability has been rated with a moderate severity.
Меры по смягчению последствий
To mitigate this vulnerability, in applications processing user-supplied dates, implement input validation to ensure the supplied date is within the supported range before calling g_date_time_add_full() with untrusted data, specifically rejecting inputs that result in a negative or zero days field.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | mingw-glib2 | Affected | ||
| Red Hat Enterprise Linux 6 | glib2 | Will not fix | ||
| Red Hat Enterprise Linux 9 | mingw-glib2 | Will not fix | ||
| Red Hat Hardened Images | glib2 | Not affected | ||
| Red Hat Enterprise Linux 10 | glib2 | Fixed | RHSA-2026:57015 | 19.08.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | glib2 | Fixed | RHSA-2026:65767 | 09.09.2026 |
| Red Hat Enterprise Linux 7 Extended Lifecycle Support | glib2 | Fixed | RHSA-2026:65773 | 09.09.2026 |
| Red Hat Enterprise Linux 8 | mingw-glib2 | Fixed | RHSA-2026:49512 | 03.08.2026 |
| Red Hat Enterprise Linux 8 | glib2 | Fixed | RHSA-2026:61766 | 31.08.2026 |
| Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | glib2 | Fixed | RHSA-2026:65762 | 09.09.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
6.5 Medium
CVSS3
Связанные уязвимости
A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the g_date_time_get_ymd function in the glib/gdatetime.c file when an invalid GDateTime object produced by the g_date_time_add_full function is processed. This flaw can corrupt the date output and potentially cause logic errors that may lead to a denial of service.
A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the g_date_time_get_ymd function in the glib/gdatetime.c file when an invalid GDateTime object produced by the g_date_time_add_full function is processed. This flaw can corrupt the date output and potentially cause logic errors that may lead to a denial of service.
Glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid gdatetime
A flaw was found in GLib. An out-of-bounds read of only 2 bytes can oc ...
A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the g_date_time_get_ymd function in the glib/gdatetime.c file when an invalid GDateTime object produced by the g_date_time_add_full function is processed. This flaw can corrupt the date output and potentially cause logic errors that may lead to a denial of service.
EPSS
6.5 Medium
CVSS3