Описание
A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary.
Отчет
Any applications loading or parsing untrusted key files, typically .desktop or .ini files, are vulnerable to this issue. This flaw can cause an off-by-one error, leading to an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary. Due to these reasons, this vulnerability has been rated with a moderate severity.
Меры по смягчению последствий
To mitigate this vulnerability, implement input validation to sanitize untrusted key files (such as .desktop or .ini files), specifically rejecting or stripping empty values before calling g_key_file_get_locale_string_list(). Alternatively, restricting the application to only load key files from trusted sources will completely neutralize this issue.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | mingw-glib2 | Affected | ||
| Red Hat Enterprise Linux 6 | glib2 | Will not fix | ||
| Red Hat Enterprise Linux 9 | mingw-glib2 | Will not fix | ||
| Red Hat Hardened Images | glib2 | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Affected | ||
| Red Hat Enterprise Linux 10 | glib2 | Fixed | RHSA-2026:57015 | 19.08.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | glib2 | Fixed | RHSA-2026:65767 | 09.09.2026 |
| Red Hat Enterprise Linux 7 Extended Lifecycle Support | glib2 | Fixed | RHSA-2026:65773 | 09.09.2026 |
| Red Hat Enterprise Linux 8 | mingw-glib2 | Fixed | RHSA-2026:49512 | 03.08.2026 |
| Red Hat Enterprise Linux 8 | glib2 | Fixed | RHSA-2026:61766 | 31.08.2026 |
Показывать по
Дополнительная информация
Статус:
7.3 High
CVSS3
Связанные уязвимости
A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary.
A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary.
Glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list"
A flaw was found in GLib. An off-by-one error can occur in the g_key_f ...
A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary.
7.3 High
CVSS3