CVE-2020-35457: Integer Overflow
DISPUTED GNOME GLib before 2.65.3 has an integer overflow, that might lead to an out-of-bounds write, in goptiongroupaddentries. NOTE: the vendor's position is "Realistically this is not a security issue. The standard pattern is for callers to provide a static list of option entries in a fixed number of calls to goptiongroupaddentries()." The researcher states that this pattern is undocumented.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID of this GNOME GLib issue?
The vulnerability ID of this GNOME GLib issue is CVE-2020-35457.
What is the severity level of CVE-2020-35457?
The severity level of CVE-2020-35457 is high with a CVSS score of 7.8.
What is the affected software of CVE-2020-35457?
The affected software of CVE-2020-35457 is GNOME GLib versions prior to 2.65.3.
What is the description of CVE-2020-35457?
CVE-2020-35457 is an integer overflow vulnerability in GNOME GLib that might lead to an out-of-bounds write in g_option_group_add_entries.
Is there a fix for CVE-2020-35457?
Yes, the fix for CVE-2020-35457 is available in version 2.65.3 of GNOME GLib.