REDHAT-BUG-2492245: Medium severity GLib g_date_time_get_ymd() vulnerability
A global-buffer-overflow (out-of-bounds read) exists in GLib's gdatetimegetymd() function, triggered when operating on an invalid GDateTime object produced by gdatetimeaddfull(). The gdatetimeaddfull() function does not validate that the resulting date falls within the supported range (years 1–9999), allowing construction of a GDateTime with a negative or zero days field. When any getter function (e.g., gdatetimegetmonth(), gdatetimegetyear()) is subsequently called, the internal gdatetimegetymd() routine computes a negative array index, causing a 2-byte OOB read from adjacent global data.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2492245?
The severity of REDHAT-BUG-2492245 is classified as medium (4).
How do I fix REDHAT-BUG-2492245?
To fix REDHAT-BUG-2492245, update GLib to the latest version where the buffer overflow vulnerability is patched.
What causes REDHAT-BUG-2492245?
REDHAT-BUG-2492245 is caused by a global-buffer-overflow in the g_date_time_get_ymd() function due to the invalid GDateTime object produced by g_date_time_add_full().
Is REDHAT-BUG-2492245 exploitable?
Yes, REDHAT-BUG-2492245 is exploitable through an out-of-bounds read when handling invalid date parameters.
Which functions are affected by REDHAT-BUG-2492245?
The affected functions in REDHAT-BUG-2492245 are g_date_time_get_ymd() and g_date_time_add_full() in GLib.