The remote host is affected by the vulnerability described in GLSA-202107-13 (GLib: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in GLib. Please review the       CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

An update of the pkg package has been released.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4526 advisory.

  - glib: integer overflow in g_byte_array_new_take function when called with a buffer of 4GB or more on a     64-bit platform (CVE-2021-27218)

  - glib: integer overflow in g_bytes_new function on 64-bit platforms due to an implicit cast from 64 bits to     32 bits (CVE-2021-27219)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:4526 advisory.

  - An issue was discovered in GNOME GLib before 2.66.7 and 2.67.x before 2.67.4. If g_byte_array_new_take()     was called with a buffer of 4GB or more on a 64-bit platform, the length would be truncated modulo 2**32,     causing unintended length truncation. (CVE-2021-27218)

  - An issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3. The function g_bytes_new has     an integer overflow on 64-bit platforms due to an implicit cast from 64 bits to 32 bits. The overflow     could potentially lead to memory corruption. (CVE-2021-27219)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3044 advisory.

  - An issue was discovered in GNOME GLib before 2.66.7 and 2.67.x before 2.67.4. If g_byte_array_new_take()     was called with a buffer of 4GB or more on a 64-bit platform, the length would be truncated modulo 2**32,     causing unintended length truncation. (CVE-2021-27218)

  - An issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3. The function g_bytes_new has     an integer overflow on 64-bit platforms due to an implicit cast from 64 bits to 32 bits. The overflow     could potentially lead to memory corruption. (CVE-2021-27219)

  - An issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is used with     G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a dangling symlink, it incorrectly also     creates the target of the symlink as an empty file, which could conceivably have security relevance if the     symlink is attacker-controlled. (If the path is a symlink to a file that already exists, then the contents     of that file correctly remain unchanged.) (CVE-2021-28153)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for glib2 fixes the following issues :

CVE-2021-27218: g_byte_array_new_take takes a gsize as length but stores in a guint, this patch will refuse if the length is larger than guint. (bsc#1182328)

CVE-2021-27219: g_memdup takes a guint as parameter and sometimes leads into an integer overflow, so add a g_memdup2 function which uses gsize to replace it. (bsc#1182362)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4759-1 advisory.

    Krzesimir Nowak discovered that GLib incorrectly handled certain large buffers. A remote attacker could     use this issue to cause applications linked to GLib to crash, resulting in a denial of service, or     possibly execute arbitrary code. (CVE-2021-27218)

    Kevin Backhouse discovered that GLib incorrectly handled certain memory allocations. A remote attacker     could use this issue to cause applications linked to GLib to crash, resulting in a denial of service, or     possibly execute arbitrary code. (CVE-2021-27219)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
156971	GLSA-202107-13 : GLib: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2022/1/24	2023/12/21	medium
203402	Photon OS 4.0: Pkg PHSA-2022-4.0-0146	Nessus	PhotonOS Local Security Checks	2024/7/23	2024/7/23	high
155053	CentOS 8 : mingw-glib2 (CESA-2021:4526)	Nessus	CentOS Local Security Checks	2021/11/11	2023/11/24	high
157727	AlmaLinux 8 : mingw-glib2 (ALSA-2021:4526)	Nessus	Alma Linux Local Security Checks	2022/2/9	2023/11/10	high
161906	Debian DLA-3044-1 : glib2.0 - LTS security update	Nessus	Debian Local Security Checks	2022/6/6	2023/10/26	medium
147796	SUSE SLED15 / SLES15 Security Update : glib2 (SUSE-SU-2021:0778-1)	Nessus	SuSE Local Security Checks	2021/3/15	2024/1/9	high
147851	SUSE SLES12 Security Update : glib2 (SUSE-SU-2021:0801-1)	Nessus	SuSE Local Security Checks	2021/3/17	2024/1/9	high
147993	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : GLib vulnerabilities (USN-4759-1)	Nessus	Ubuntu Local Security Checks	2021/3/23	2024/8/27	high

检测

插件搜索

medium

high

high

high

medium

high

high

high