Denial of Service Vulnerability in GNOME GLib 2.59.2

CVE-2019-9633

Summary

In GNOME GLib version 2.59.2, a flaw exists in gio/gsocketclient.c that fails to keep the parent GTask active during the execution of connection attempts. This oversight can be exploited by remote attackers, leading to potential denial of service. Specifically, an attacker may craft a malicious web page that triggers mishandling within the g_socket_client_connected_callback, resulting in application crashes, and thereby disrupting the service provided by the affected application.

References