Buffer Overflow in GNOME GLib's gio/gsocks4aproxy Due to Off-by-One Error
CVE-2024-52533

9.8CRITICAL

Key Information:

Vendor

GNOME GLib

Status
Glib
Vendor
CVE Published:
11 November 2024

What is CVE-2024-52533?

The GNOME GLib library contains a buffer overflow vulnerability due to an off-by-one error in the 'gio/gsocks4aproxy.c' file. This occurs because the defined length for the SOCKS4 connection message is insufficient to accommodate a null-terminating character, potentially leading to memory corruption and unauthorized code execution in applications relying on this library.

References

https://gitlab.gnome.org/Teams/Releng/security/-/wikis/home
https://gitlab.gnome.org/GNOME/glib/-/issues/3461
https://gitlab.gnome.org/GNOME/glib/-/releases/2.82.1

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.