GNOME GLib before 2.65.3 has an integer overflow, that might lead to an out-of-bounds write, in g_option_group_add_entries. NOTE: the vendor's position is "Realistically this is not a security issue. The standard pattern is for callers to provide a static list of option entries in a fixed number of calls to g_option_group_add_entries()." The researcher states that this pattern is undocumented

An update of the pkg package has been released.

The version of glib2 installed on the remote host is prior to 2.56.1-9. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2519 advisory.

    GNOME GLib before 2.65.3 has an integer overflow, that might lead to an out-of-bounds write, in     g_option_group_add_entries. NOTE: the vendor's position is Realistically this is not a security issue.
    The standard pattern is for callers to provide a static list of option entries in a fixed number of calls     to g_option_group_add_entries(). The researcher states that this pattern is undocumented (CVE-2020-35457)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of glib2 installed on the remote host is prior to 2.36.3-5.27. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1929 advisory.

    GNOME GLib before 2.65.3 has an integer overflow, that might lead to an out-of-bounds write, in     g_option_group_add_entries. NOTE: the vendor's position is Realistically this is not a security issue.
    The standard pattern is for callers to provide a static list of option entries in a fixed number of calls     to g_option_group_add_entries(). The researcher states that this pattern is undocumented (CVE-2020-35457)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the glib2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - ** DISPUTED ** GNOME GLib before 2.65.3 has an integer overflow, that might lead to an out-of-bounds     write, in g_option_group_add_entries. NOTE: the vendor's position is 'Realistically this is not a security     issue. The standard pattern is for callers to provide a static list of option entries in a fixed number of     calls to g_option_group_add_entries().' The researcher states that this pattern is undocumented.
    (CVE-2020-35457)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the glib2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - ** DISPUTED ** GNOME GLib before 2.65.3 has an integer overflow, that might lead to an out-of-bounds     write, in g_option_group_add_entries. NOTE: the vendor's position is 'Realistically this is not a security     issue. The standard pattern is for callers to provide a static list of option entries in a fixed number of     calls to g_option_group_add_entries().' The researcher states that this pattern is undocumented.
    (CVE-2020-35457)

  - An issue was discovered in GNOME GLib before 2.66.7 and 2.67.x before 2.67.4. If g_byte_array_new_take()     was called with a buffer of 4GB or more on a 64-bit platform, the length would be truncated modulo 2**32,     causing unintended length truncation. (CVE-2021-27218)

  - An issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3. The function g_bytes_new has     an integer overflow on 64-bit platforms due to an implicit cast from 64 bits to 32 bits. The overflow     could potentially lead to memory corruption. (CVE-2021-27219)

  - An issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is used with     G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a dangling symlink, it incorrectly also     creates the target of the symlink as an empty file, which could conceivably have security relevance if the     symlink is attacker-controlled. (If the path is a symlink to a file that already exists, then the contents     of that file correctly remain unchanged.) (CVE-2021-28153)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the glib2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - ** DISPUTED ** GNOME GLib before 2.65.3 has an integer overflow, that might lead to an out-of-bounds     write, in g_option_group_add_entries. NOTE: the vendor's position is 'Realistically this is not a security     issue. The standard pattern is for callers to provide a static list of option entries in a fixed number of     calls to g_option_group_add_entries().' The researcher states that this pattern is undocumented.
    (CVE-2020-35457)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the glib2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - GNOME GLib before 2.65.3 has an integer overflow, that     might lead to an out-of-bounds write, in     g_option_group_add_entries. NOTE: the vendor's position     is 'Realistically this is not a security issue. The     standard pattern is for callers to provide a static     list of option entries in a fixed number of calls to     g_option_group_add_entries().' The researcher states     that this pattern is undocumented.(CVE-2020-35457)

  - An issue was discovered in GNOME GLib before 2.66.7 and     2.67.x before 2.67.4. If g_byte_array_new_take() was     called with a buffer of 4GB or more on a 64-bit     platform, the length would be truncated modulo 2**32,     causing unintended length truncation.(CVE-2021-27218)

  - An issue was discovered in GNOME GLib before 2.66.6 and     2.67.x before 2.67.3. The function g_bytes_new has an     integer overflow on 64-bit platforms due to an implicit     cast from 64 bits to 32 bits. The overflow could     potentially lead to memory corruption.(CVE-2021-27219)

  - An issue was discovered in GNOME GLib before 2.66.8.
    When g_file_replace() is used with     G_FILE_CREATE_REPLACE_DESTINATION to replace a path     that is a dangling symlink, it incorrectly also creates     the target of the symlink as an empty file, which could     conceivably have security relevance if the symlink is     attacker-controlled. (If the path is a symlink to a     file that already exists, then the contents of that     file correctly remain unchanged.)(CVE-2021-28153)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the glib2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - GNOME GLib before 2.65.3 has an integer overflow, that     might lead to an out-of-bounds write, in     g_option_group_add_entries. NOTE: the vendor's position     is 'Realistically this is not a security issue. The     standard pattern is for callers to provide a static     list of option entries in a fixed number of calls to     g_option_group_add_entries().' The researcher states     that this pattern is undocumented.(CVE-2020-35457)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the glib2 packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in GNOME GLib before 2.66.6 and     2.67.x before 2.67.3. The function g_bytes_new has an     integer overflow on 64-bit platforms due to an implicit     cast from 64 bits to 32 bits. The overflow could     potentially lead to memory corruption.(CVE-2021-27219)

  - An issue was discovered in GNOME GLib before 2.66.7 and     2.67.x before 2.67.4. If g_byte_array_new_take() was     called with a buffer of 4GB or more on a 64-bit     platform, the length would be truncated modulo 2**32,     causing unintended length truncation.(CVE-2021-27218)

  - An issue was discovered in GNOME GLib before 2.66.8.
    When g_file_replace() is used with     G_FILE_CREATE_REPLACE_DESTINATION to replace a path     that is a dangling symlink, it incorrectly also creates     the target of the symlink as an empty file, which could     conceivably have security relevance if the symlink is     attacker-controlled. (If the path is a symlink to a     file that already exists, then the contents of that     file correctly remain unchanged.)(CVE-2021-28153)

  - ** DISPUTED ** GNOME GLib before 2.65.3 has an integer     overflow, that might lead to an out-of-bounds write, in     g_option_group_add_entries. NOTE: the vendor's position     is 'Realistically this is not a security issue. The     standard pattern is for callers to provide a static     list of option entries in a fixed number of calls to     g_option_group_add_entries().' The researcher states     that this pattern is undocumented.(CVE-2020-35457)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the glib2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - GNOME GLib before 2.65.3 has an integer overflow, that     might lead to an out-of-bounds write, in     g_option_group_add_entries. NOTE: the vendor's position     is 'Realistically this is not a security issue. The     standard pattern is for callers to provide a static     list of option entries in a fixed number of calls to     g_option_group_add_entries().' The researcher states     that this pattern is undocumented.(CVE-2020-35457)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the glib2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - ** DISPUTED ** GNOME GLib before 2.65.3 has an integer     overflow, that might lead to an out-of-bounds write, in     g_option_group_add_entries. NOTE: the vendor's position     is 'Realistically this is not a security issue. The     standard pattern is for callers to provide a static     list of option entries in a fixed number of calls to     g_option_group_add_entries().' The researcher states     that this pattern is undocumented.(CVE-2020-35457)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the glib2 packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - ** DISPUTED ** GNOME GLib before 2.65.3 has an integer     overflow, that might lead to an out-of-bounds write, in     g_option_group_add_entries. NOTE: the vendor's position     is 'Realistically this is not a security issue. The     standard pattern is for callers to provide a static     list of option entries in a fixed number of calls to     g_option_group_add_entries().' The researcher states     that this pattern is undocumented.(CVE-2020-35457)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the glib package has been released.

According to the version of the glib2 package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - GNOME GLib before 2.65.3 has an integer overflow, that     might lead to an out-of-bounds write, in     g_option_group_add_entries. NOTE: the vendor's position     is 'Realistically this is not a security issue. The     standard pattern is for callers to provide a static     list of option entries in a fixed number of calls to     g_option_group_add_entries().' The researcher states     that this pattern is undocumented.(CVE-2020-35457)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
203402	Photon OS 4.0: Pkg PHSA-2022-4.0-0146	Nessus	PhotonOS Local Security Checks	high
193528	Amazon Linux 2 : glib2 (ALAS-2024-2519)	Nessus	Amazon Linux Local Security Checks	high
193380	Amazon Linux AMI : glib2 (ALAS-2024-1929)	Nessus	Amazon Linux Local Security Checks	high
157973	EulerOS Virtualization 3.0.6.6 : glib2 (EulerOS-SA-2022-1121)	Nessus	Huawei Local Security Checks	high
156586	Photon OS 3.0: Pkg PHSA-2021-3.0-0346	Nessus	PhotonOS Local Security Checks	high
156530	EulerOS Virtualization 3.0.2.6 : glib2 (EulerOS-SA-2021-2869)	Nessus	Huawei Local Security Checks	high
154364	EulerOS 2.0 SP3 : glib2 (EulerOS-SA-2021-2580)	Nessus	Huawei Local Security Checks	high
153319	EulerOS 2.0 SP2 : glib2 (EulerOS-SA-2021-2373)	Nessus	Huawei Local Security Checks	high
153076	EulerOS 2.0 SP5 : glib2 (EulerOS-SA-2021-2329)	Nessus	Huawei Local Security Checks	high
151298	EulerOS Virtualization for ARM 64 3.0.2.0 : glib2 (EulerOS-SA-2021-2117)	Nessus	Huawei Local Security Checks	high
147673	EulerOS Virtualization 2.9.0 : glib2 (EulerOS-SA-2021-1644)	Nessus	Huawei Local Security Checks	high
147488	EulerOS Virtualization 2.9.1 : glib2 (EulerOS-SA-2021-1599)	Nessus	Huawei Local Security Checks	high
147078	EulerOS Virtualization for ARM 64 3.0.6.0 : glib2 (EulerOS-SA-2021-1571)	Nessus	Huawei Local Security Checks	high
145761	EulerOS 2.0 SP8 : glib2 (EulerOS-SA-2021-1141)	Nessus	Huawei Local Security Checks	high
144901	Photon OS 1.0: Glib PHSA-2021-1.0-0351	Nessus	PhotonOS Local Security Checks	high
144899	Photon OS 3.0: Glib PHSA-2021-3.0-0181	Nessus	PhotonOS Local Security Checks	high
144893	Photon OS 2.0: Glib PHSA-2021-2.0-0308	Nessus	PhotonOS Local Security Checks	high
144698	EulerOS 2.0 SP9 : glib2 (EulerOS-SA-2021-1004)	Nessus	Huawei Local Security Checks	high
144656	EulerOS 2.0 SP9 : glib2 (EulerOS-SA-2021-1023)	Nessus	Huawei Local Security Checks	high

Detections

Analytics

CVE-2020-35457

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high