CVE-2020-35457: Integer Overflow or Wraparound

December 14, 2020 (updated July 21, 2021)

** DISPUTED ** GNOME GLib has an integer overflow, that might lead to an out-of-bounds write, in g_option_group_add_entries. NOTE: the vendor’s position is “Realistically this is not a security issue. The standard pattern is for callers to provide a static list of option entries in a fixed number of calls to g_option_group_add_entries().” The researcher states that this pattern is undocumented.

References

gitlab.gnome.org/GNOME/glib/-/commit/63c5b62f0a984fac9a9700b12f54fe878e016a5d
gitlab.gnome.org/GNOME/glib/-/issues/2197
gitlab.gnome.org/GNOME/glib/-/releases/2.65.3
nvd.nist.gov/vuln/detail/CVE-2020-35457

Code Behaviors & Features

Detect and mitigate CVE-2020-35457 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →