CVE-2021-27219: Integer Overflow
An integer wraparound was discovered in glib due to passing a 64 bit sized value to function gmemdup() which accepts a 32 bits number as argument. An attacker may abuse this flaw when an application linked against the glib library uses gbytesnew() function or possibly other functions that use gmemdup() underneath and accept a 64 bits argument as size. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Other sources
An issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3. The function gbytesnew has an integer overflow on 64-bit platforms due to an implicit cast from 64 bits to 32 bits. The overflow could potentially lead to memory corruption.
GNOME GLib could allow a remote attacker to cause a denial of service, caused by an integer overflow in the gbytesnew function. An attacker could exploit this vulnerability to corrupt memory and cause a denial of service.
— IBM
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-27219?
CVE-2021-27219 is a vulnerability in GNOME GLib that could allow a remote attacker to cause a denial of service.
What is the severity of CVE-2021-27219?
The severity of CVE-2021-27219 is critical, with a severity value of 9.8.
How do I fix CVE-2021-27219?
To fix CVE-2021-27219, update to version 2.67.3 of the glib library or the appropriate version for your operating system.
Where can I find more information about CVE-2021-27219?
You can find more information about CVE-2021-27219 in the GitLab issue and the Red Hat bugzilla.
What are the CWEs associated with CVE-2021-27219?
The CWEs associated with CVE-2021-27219 are CWE-190, CWE-787, and CWE-681.