CVE-2008-4316
published 2009-03-14CVE-2008-4316: Multiple integer overflows in glib/gbase64.c in GLib before 2.20 allow context-dependent attackers to execute arbitrary code via a long string that is…
PriorityP421medium4.6CVSS 2.0
AVLACLAuNCPIPAP
EPSS
0.49%
39.2th percentile
Multiple integer overflows in glib/gbase64.c in GLib before 2.20 allow context-dependent attackers to execute arbitrary code via a long string that is converted either (1) from or (2) to a base64 representation.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | glib2.0 | < glib2.0 2.20.0-1 (bookworm) | glib2.0 2.20.0-1 (bookworm) |
| gnome | glib | <= 2.16.4 | — |
| gnome | glib | — | — |
| gnome | glib | — | — |
| gnome | glib | — | — |
| gnome | glib | — | — |
CVSS provenance
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
osv4.6MEDIUM
vendor_debian4.6MEDIUM
vendor_redhat4.6MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-96v6-2hh2-wxrr: Multiple integer overflows in glib/gbase64
ghsa_unreviewed·2022-05-02
CVE-2008-4316 [MEDIUM] GHSA-96v6-2hh2-wxrr: Multiple integer overflows in glib/gbase64
Multiple integer overflows in glib/gbase64.c in GLib before 2.20 allow context-dependent attackers to execute arbitrary code via a long string that is converted either (1) from or (2) to a base64 representation.
OSV
CVE-2008-4316: Multiple integer overflows in glib/gbase64
osv·2009-03-14·CVSS 4.6
CVE-2008-4316 [MEDIUM] CVE-2008-4316: Multiple integer overflows in glib/gbase64
Multiple integer overflows in glib/gbase64.c in GLib before 2.20 allow context-dependent attackers to execute arbitrary code via a long string that is converted either (1) from or (2) to a base64 representation.
Ubuntu
GLib vulnerability
vendor_ubuntu·2009-03-16
CVE-2008-4316 GLib vulnerability
Title: GLib vulnerability
Summary: GLib vulnerability
Diego Petteno discovered that the Base64 encoding functions in GLib did not
properly handle large strings. If a user or automated system were tricked
into processing a crafted Base64 string, an attacker could possibly execute
arbitrary code with the privileges of the user invoking the program.
Instructions: After a standard system upgrade you need to reboot your computer to effect
the necessary changes.
Red Hat
glib2: integer overflows in the base64 handling functions (oCERT-2008-015)
vendor_redhat·2009-03-12·CVSS 4.6
CVE-2008-4316 [MEDIUM] CWE-190 glib2: integer overflows in the base64 handling functions (oCERT-2008-015)
glib2: integer overflows in the base64 handling functions (oCERT-2008-015)
Multiple integer overflows in glib/gbase64.c in GLib before 2.20 allow context-dependent attackers to execute arbitrary code via a long string that is converted either (1) from or (2) to a base64 representation.
Debian
CVE-2008-4316: glib2.0 - Multiple integer overflows in glib/gbase64.c in GLib before 2.20 allow context-d...
vendor_debian·2008·CVSS 4.6
CVE-2008-4316 [MEDIUM] CVE-2008-4316: glib2.0 - Multiple integer overflows in glib/gbase64.c in GLib before 2.20 allow context-d...
Multiple integer overflows in glib/gbase64.c in GLib before 2.20 allow context-dependent attackers to execute arbitrary code via a long string that is converted either (1) from or (2) to a base64 representation.
Scope: local
bookworm: resolved (fixed in 2.20.0-1)
bullseye: resolved (fixed in 2.20.0-1)
forky: resolved (fixed in 2.20.0-1)
sid: resolved (fixed in 2.20.0-1)
trixie: resolved (fixed in 2.20.0-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2009-0587 evolution-data-server: integer overflow in base64 encoding functions
bugzilla·2009-03-03·CVSS 4.6
CVE-2009-0587 [MEDIUM] CVE-2009-0587 evolution-data-server: integer overflow in base64 encoding functions
CVE-2009-0587 evolution-data-server: integer overflow in base64 encoding functions
Evolution Data Server contained multiple copies of base64_encode_simple function similar to one now implemented in glib2, that were affected by the glib2's CVE-2008-4316 integer overflow issue.
out = g_malloc (len * 4 / 3 + 5);
If the affected functions were used on large untrusted inputs, memory requirement computation may overflow, resulting in an insufficient memory allocation and heap-based buffer overflow during the base64 encode of the supplied data.
Affected code existed in:
- _evc_base64_encode_simple() in addressbook/libebook/e-vcard.c, can possibly be triggered by malicious LDAP address book backend
- camel_base64_encode_simple() in camel/camel-mime-utils.c, can possibly be triggered by NTLM
Bugzilla
CVE-2009-0585 libsoup: integer overflow in soup_base64_encode()
bugzilla·2009-03-02·CVSS 4.6
CVE-2009-0585 [MEDIUM] CVE-2009-0585 libsoup: integer overflow in soup_base64_encode()
CVE-2009-0585 libsoup: integer overflow in soup_base64_encode()
Older versions of libsoup are prone to integer overflow in memory requirement computation in the soup_base64_encode() in libsoup/soup-misc.c:
216 char *
217 soup_base64_encode (const char *text, int len)
218 {
219 unsigned char *out;
220 int state = 0, outlen, save = 0;
221
222 out = g_malloc (len * 4 / 3 + 5);
If the large enough untrusted input is passed to the function, insufficient amount of memory is allocated, followed by a heap-based buffer overflow with the Base64 encoded data.
Note: This issue does not affect current upstream versions of libsoup. Newer version in 2.2.x branch implement base64 encoding / decoding functions as thin wrappers around functions provided by glib; 2.4.x branch does not provide base64 enco
Bugzilla
CVE-2008-4316 glib2: integer overflows in the base64 handling functions (oCERT-2008-015)
bugzilla·2008-12-05·CVSS 4.6
CVE-2008-4316 [MEDIUM] CVE-2008-4316 glib2: integer overflows in the base64 handling functions (oCERT-2008-015)
CVE-2008-4316 glib2: integer overflows in the base64 handling functions (oCERT-2008-015)
oCERT team notified us about discovered by Diego Pettenò in glib:
Base64 encoding and decoding functions in glib suffer from vulnerabilities during memory allocations which may result in arbitrary code execution when processing large strings.
g_base64_encode and g_base64_decode allocate memory for their respective behavior using a similar pattern:
ret = g_malloc0 (input_length * 3 / 4);
In g_base64_decode, input_length is typed as a gint and its value is derived directly from a strlen(3) call over an input string. Since the multiplication is evaluated prior to the division, an input_length greater than (UINT_MAX/3), or 1431655765, will wrap resulting in smaller allocation than required. It is also
http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00014.htmlhttp://lists.vmware.com/pipermail/security-announce/2010/000082.htmlhttp://ocert.org/patches/2008-015/glib-CVE-2008-4316.diffhttp://openwall.com/lists/oss-security/2009/03/12/2http://secunia.com/advisories/34267http://secunia.com/advisories/34317http://secunia.com/advisories/34404http://secunia.com/advisories/34416http://secunia.com/advisories/34560http://secunia.com/advisories/34854http://secunia.com/advisories/34890http://secunia.com/advisories/38794http://secunia.com/advisories/38833http://svn.gnome.org/viewvc/glib?view=revision&revision=7973http://wiki.rpath.com/Advisories:rPSA-2009-0045http://www.debian.org/security/2009/dsa-1747http://www.mandriva.com/security/advisories?name=MDVSA-2009:080http://www.ocert.org/advisories/ocert-2008-015.htmlhttp://www.openwall.com/lists/oss-security/2009/03/16/2http://www.redhat.com/archives/fedora-package-announce/2009-April/msg00744.htmlhttp://www.redhat.com/support/errata/RHSA-2009-0336.htmlhttp://www.securityfocus.com/archive/1/501712/100/0/threadedhttp://www.securityfocus.com/archive/1/501766/100/0/threadedhttp://www.securityfocus.com/bid/34100http://www.securitytracker.com/id?1021884http://www.ubuntu.com/usn/usn-738-1http://www.vupen.com/english/advisories/2010/0528https://exchange.xforce.ibmcloud.com/vulnerabilities/49272https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11401https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8360https://www.redhat.com/archives/fedora-package-announce/2009-March/msg01113.htmlhttp://lists.opensuse.org/opensuse-security-announce/2009-04/msg00014.htmlhttp://lists.vmware.com/pipermail/security-announce/2010/000082.htmlhttp://ocert.org/patches/2008-015/glib-CVE-2008-4316.diffhttp://openwall.com/lists/oss-security/2009/03/12/2http://secunia.com/advisories/34267http://secunia.com/advisories/34317http://secunia.com/advisories/34404http://secunia.com/advisories/34416http://secunia.com/advisories/34560http://secunia.com/advisories/34854http://secunia.com/advisories/34890http://secunia.com/advisories/38794http://secunia.com/advisories/38833http://svn.gnome.org/viewvc/glib?view=revision&revision=7973http://wiki.rpath.com/Advisories:rPSA-2009-0045http://www.debian.org/security/2009/dsa-1747http://www.mandriva.com/security/advisories?name=MDVSA-2009:080http://www.ocert.org/advisories/ocert-2008-015.htmlhttp://www.openwall.com/lists/oss-security/2009/03/16/2http://www.redhat.com/archives/fedora-package-announce/2009-April/msg00744.htmlhttp://www.redhat.com/support/errata/RHSA-2009-0336.htmlhttp://www.securityfocus.com/archive/1/501712/100/0/threadedhttp://www.securityfocus.com/archive/1/501766/100/0/threadedhttp://www.securityfocus.com/bid/34100http://www.securitytracker.com/id?1021884http://www.ubuntu.com/usn/usn-738-1http://www.vupen.com/english/advisories/2010/0528https://exchange.xforce.ibmcloud.com/vulnerabilities/49272https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11401https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8360https://www.redhat.com/archives/fedora-package-announce/2009-March/msg01113.html
2009-03-14
Published