REDHAT-BUG-2492255: Medium severity GLib vulnerability
A heap-buffer-overflow READ of 1 byte occurs in gkeyfilegetlocalestringlist() at gkeyfile.c:2464 when the resolved locale string value is an empty string (""). The function computes len = strlen(value) which yields 0, then accesses value[len - 1]. Since len is gsize(unsigned), len - 1 wraps to SIZEMAX, causing a read of 1 byte before the heap allocation (under-read). Any application that loads a key file from untrusted input and calls gkeyfilegetlocalestringlist() on a key whose value is empty is affected. The key file format is commonly used for .desktop files and application configuration.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2492255?
The severity of REDHAT-BUG-2492255 is medium, rated at 4.
What is the nature of the vulnerability in REDHAT-BUG-2492255?
REDHAT-BUG-2492255 involves a heap-buffer-overflow read of 1 byte occurring in g_key_file_get_locale_string_list() when the locale string value is an empty string.
How do I fix REDHAT-BUG-2492255?
To fix REDHAT-BUG-2492255, software updates or patches addressing the issue in GLib should be applied as they become available.
What software is affected by REDHAT-BUG-2492255?
The software affected by REDHAT-BUG-2492255 is GLib.
What is the impact of REDHAT-BUG-2492255?
The impact of REDHAT-BUG-2492255 could lead to potential instability or undefined behavior in applications using the affected function when handling empty locale strings.