Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Informations | |||
---|---|---|---|
Name | CVE-2008-4316 | First vendor Publication | 2009-03-14 |
Vendor | Cve | Last vendor Modification | 2024-11-21 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:L/AC:L/Au:N/C:P/I:P/A:P) | |||
---|---|---|---|
Cvss Base Score | 4.6 | Attack Range | Local |
Cvss Impact Score | 6.4 | Attack Complexity | Low |
Cvss Expoit Score | 3.9 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Multiple integer overflows in glib/gbase64.c in GLib before 2.20 allow context-dependent attackers to execute arbitrary code via a long string that is converted either (1) from or (2) to a base64 representation. |
Original Source
Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4316 |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
100 % | CWE-189 | Numeric Errors (CWE/SANS Top 25) |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:11401 | |||
Oval ID: | oval:org.mitre.oval:def:11401 | ||
Title: | Multiple integer overflows in glib/gbase64.c in GLib before 2.20 allow context-dependent attackers to execute arbitrary code via a long string that is converted either (1) from or (2) to a base64 representation. | ||
Description: | Multiple integer overflows in glib/gbase64.c in GLib before 2.20 allow context-dependent attackers to execute arbitrary code via a long string that is converted either (1) from or (2) to a base64 representation. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2008-4316 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:13648 | |||
Oval ID: | oval:org.mitre.oval:def:13648 | ||
Title: | DSA-1747-1 glib2.0 -- integer overflow | ||
Description: | Diego Petten discovered that glib2.0, the GLib library of C routines, handles large strings insecurely via its Base64 encoding functions. This could possible lead to the execution of arbitrary code. For the stable distribution, this problem has been fixed in version 2.16.6-1+lenny1. For the oldstable distribution, this problem has been fixed in version 2.12.4-2+etch1. For the testing distribution, this problem will be fixed soon. For the unstable distribution, this problem has been fixed in version 2.20.0-1. We recommend that you upgrade your glib2.0 packages. | ||
Family: | unix | Class: | patch |
Reference(s): | DSA-1747-1 CVE-2008-4316 | Version: | 5 |
Platform(s): | Debian GNU/Linux 5.0 Debian GNU/Linux 4.0 | Product(s): | glib2.0 |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:13879 | |||
Oval ID: | oval:org.mitre.oval:def:13879 | ||
Title: | USN-738-1 -- glib2.0 vulnerability | ||
Description: | Diego Petten discovered that the Base64 encoding functions in GLib did not properly handle large strings. If a user or automated system were tricked into processing a crafted Base64 string, an attacker could possibly execute arbitrary code with the privileges of the user invoking the program. | ||
Family: | unix | Class: | patch |
Reference(s): | USN-738-1 CVE-2008-4316 | Version: | 5 |
Platform(s): | Ubuntu 7.10 Ubuntu 8.10 Ubuntu 8.04 | Product(s): | glib2.0 |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:22678 | |||
Oval ID: | oval:org.mitre.oval:def:22678 | ||
Title: | ELSA-2009:0336: glib2 security update (Moderate) | ||
Description: | Multiple integer overflows in glib/gbase64.c in GLib before 2.20 allow context-dependent attackers to execute arbitrary code via a long string that is converted either (1) from or (2) to a base64 representation. | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2009:0336-01 CVE-2008-4316 | Version: | 6 |
Platform(s): | Oracle Linux 5 | Product(s): | glib2 |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:29068 | |||
Oval ID: | oval:org.mitre.oval:def:29068 | ||
Title: | RHSA-2009:0336 -- glib2 security update (Moderate) | ||
Description: | Updated glib2 packages that fix several security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. GLib is the low-level core library that forms the basis for projects such as GTK+ and GNOME. It provides data structure handling for C, portability wrappers, and interfaces for such runtime functionality as an event loop, threads, dynamic loading, and an object system. | ||
Family: | unix | Class: | patch |
Reference(s): | RHSA-2009:0336 CVE-2008-4316 | Version: | 3 |
Platform(s): | Red Hat Enterprise Linux 5 | Product(s): | glib2 |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:8105 | |||
Oval ID: | oval:org.mitre.oval:def:8105 | ||
Title: | DSA-1747 glib2.0 -- integer overflow | ||
Description: | Diego Pettenograve discovered that glib2.0, the GLib library of C routines, handles large strings insecurely via its Base64 encoding functions. This could possible lead to the execution of arbitrary code. | ||
Family: | unix | Class: | patch |
Reference(s): | DSA-1747 CVE-2008-4316 | Version: | 3 |
Platform(s): | Debian GNU/Linux 5.0 Debian GNU/Linux 4.0 | Product(s): | glib2.0 |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:8360 | |||
Oval ID: | oval:org.mitre.oval:def:8360 | ||
Title: | VMware glib2 vulnerability | ||
Description: | Multiple integer overflows in glib/gbase64.c in GLib before 2.20 allow context-dependent attackers to execute arbitrary code via a long string that is converted either (1) from or (2) to a base64 representation. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2008-4316 | Version: | 4 |
Platform(s): | VMWare ESX Server 4.0 | Product(s): | |
Definition Synopsis: | |||
CPE : Common Platform Enumeration
OpenVAS Exploits
Date | Description |
---|---|
2009-10-11 | Name : SLES11: Security update for glib2 File : nvt/sles11_glib2.nasl |
2009-06-05 | Name : Ubuntu USN-744-1 (lcms) File : nvt/ubuntu_744_1.nasl |
2009-06-05 | Name : Ubuntu USN-743-1 (gs-gpl) File : nvt/ubuntu_743_1.nasl |
2009-04-28 | Name : Fedora Core 10 FEDORA-2009-2657 (glib2) File : nvt/fcore_2009_2657.nasl |
2009-04-28 | Name : SuSE Security Advisory SUSE-SA:2009:026 (glib2) File : nvt/suse_sa_2009_026.nasl |
2009-04-06 | Name : Ubuntu USN-747-1 (icu) File : nvt/ubuntu_747_1.nasl |
2009-04-06 | Name : Ubuntu USN-746-1 (xine-lib) File : nvt/ubuntu_746_1.nasl |
2009-04-06 | Name : Mandrake Security Advisory MDVSA-2009:085 (gstreamer0.10-plugins-base) File : nvt/mdksa_2009_085.nasl |
2009-04-06 | Name : Mandrake Security Advisory MDVSA-2009:080 (glib2.0) File : nvt/mdksa_2009_080.nasl |
2009-04-06 | Name : Gentoo Security Advisory GLSA 200904-02 (glib) File : nvt/glsa_200904_02.nasl |
2009-04-06 | Name : Fedora Core 9 FEDORA-2009-2688 (glib2) File : nvt/fcore_2009_2688.nasl |
2009-03-31 | Name : Debian Security Advisory DSA 1747-1 (glib2.0) File : nvt/deb_1747_1.nasl |
2009-03-31 | Name : RedHat Security Advisory RHSA-2009:0336 File : nvt/RHSA_2009_0336.nasl |
2009-03-20 | Name : Ubuntu USN-733-1 (evolution-data-server) File : nvt/ubuntu_733_1.nasl |
2009-03-20 | Name : Ubuntu USN-734-1 (ffmpeg-debian) File : nvt/ubuntu_734_1.nasl |
2009-03-20 | Name : Ubuntu USN-738-1 (glib2.0) File : nvt/ubuntu_738_1.nasl |
0000-00-00 | Name : Slackware Advisory SSA:2009-086-02 glib2 File : nvt/esoft_slk_ssa_2009_086_02.nasl |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
56386 | GLib glib/gbase64.c Base64 Conversion Overflow |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2016-03-08 | Name : The remote VMware ESX host is missing a security-related patch. File : vmware_VMSA-2010-0004_remote.nasl - Type : ACT_GATHER_INFO |
2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2009-0336.nasl - Type : ACT_GATHER_INFO |
2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20090324_glib2_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
2010-03-05 | Name : The remote VMware ESX host is missing one or more security-related patches. File : vmware_VMSA-2010-0004.nasl - Type : ACT_GATHER_INFO |
2009-09-24 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_glib2-090422.nasl - Type : ACT_GATHER_INFO |
2009-07-21 | Name : The remote openSUSE host is missing a security update. File : suse_11_0_glib2-090422.nasl - Type : ACT_GATHER_INFO |
2009-07-21 | Name : The remote openSUSE host is missing a security update. File : suse_11_1_glib2-090422.nasl - Type : ACT_GATHER_INFO |
2009-04-27 | Name : The remote Fedora host is missing a security update. File : fedora_2009-2657.nasl - Type : ACT_GATHER_INFO |
2009-04-27 | Name : The remote openSUSE host is missing a security update. File : suse_glib2-6209.nasl - Type : ACT_GATHER_INFO |
2009-04-23 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-080.nasl - Type : ACT_GATHER_INFO |
2009-04-23 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-085.nasl - Type : ACT_GATHER_INFO |
2009-04-23 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-738-1.nasl - Type : ACT_GATHER_INFO |
2009-04-06 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200904-02.nasl - Type : ACT_GATHER_INFO |
2009-04-01 | Name : The remote Fedora host is missing a security update. File : fedora_2009-2688.nasl - Type : ACT_GATHER_INFO |
2009-03-30 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2009-086-02.nasl - Type : ACT_GATHER_INFO |
2009-03-25 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2009-0336.nasl - Type : ACT_GATHER_INFO |
2009-03-22 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1747.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
Date | Informations |
---|---|
2024-11-28 23:11:54 |
|
2024-11-28 12:16:37 |
|
2023-02-13 09:29:20 |
|
2023-02-02 17:28:14 |
|
2021-05-04 12:08:07 |
|
2021-04-22 01:08:28 |
|
2020-05-24 01:04:49 |
|
2020-05-23 00:22:20 |
|
2018-10-12 00:20:28 |
|
2017-09-29 09:23:45 |
|
2017-08-08 09:24:25 |
|
2016-04-26 17:51:57 |
|
2016-03-09 13:25:54 |
|
2014-02-17 10:46:48 |
|
2013-05-11 00:27:14 |
|