CVE Feed

    Dashboard / CVE / CVE-2021-27219

    CVE-2021-27219

    An issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3. The function g_bytes_new has an integer overflow on 64-bit platforms due to an implicit cast from 64 bits to 32 bits. The overflow could potentially lead to memory corruption.

    Published:Feb 4, 2021
    Last Modified:Nov 21, 2024
    EPS:Feb 15, 2021
    EPSS Score:0.0029
    CVSS Score:7.5

    Affected Products

    Vendor
    Broadcom
    Product
    Brocade Fabric Operating System Firmware
    Vendor
    Debian
    Product
    Debian Linux
    Vendor
    Fedoraproject
    Product
    Fedora
    Vendor
    Gnome
    Product
    Glib
    Vendor
    Netapp
    Product
    Active Iq Unified Manager
    Vendor
    Netapp
    Product
    Cloud Backup
    Vendor
    Netapp
    Product
    E-series Performance Analyzer
    Vendor
    Redhat
    Product
    Enterprise Linux
    Vendor
    Redhat
    Product
    Rhel Aus
    Vendor
    Redhat
    Product
    Rhel E4s
    Vendor
    Redhat
    Product
    Rhel Els
    Vendor
    Redhat
    Product
    Rhel Eus
    Vendor
    Redhat
    Product
    Rhel Tus
    Vendor
    Redhat
    Product
    Rhev Hypervisor
    Vendor
    Redhat
    Product
    Rhmt

    Exploits

    https://gitlab.gnome.org/GNOME/glib/-/issues/2319https://gitlab.gnome.org/GNOME/glib/-/issues/2319

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-92 Forced Integer Overflow

    Related CVEs

    CVE-2023-27538 (CVSS 5.5) — An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously establis…
    CVE-2023-27534 (CVSS 8.8) — A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be …
    CVE-2023-27537 (CVSS 5.9) — A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This s…
    CVE-2021-36160 (CVSS 7.5) — A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (D…
    CVE-2021-40438 (CVSS 9) — A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remot…
    CVE-2021-34798 (CVSS 7.5) — Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2…
    CVE-2021-4197 (CVSS 7.8) — An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces subsystem w…
    CVE-2021-28153 (CVSS 5.3) — An issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is used with G_FILE_CREATE_REPLACE_…
    CVE-2021-27218 (CVSS 7.5) — An issue was discovered in GNOME GLib before 2.66.7 and 2.67.x before 2.67.4. If g_byte_array_new_take() was c…
    CVE-2021-20197 (CVSS 6.3) — There is an open race window when writing output in the following utilities in GNU binutils version 2.35 and e…

    References

    https://gitlab.gnome.org/GNOME/glib/-/issues/2319
    https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E
    https://lists.debian.org/debian-lts-announce/2022/06/msg00006.html
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2REA7RVKN7ZHRLJOEGBRQKJIPZQPAELZ/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JJMPNDO4GDVURYQFYKFOWY5HAF4FTEPN/
    https://security.gentoo.org/glsa/202107-13
    https://security.netapp.com/advisory/ntap-20210319-0004/
    https://gitlab.gnome.org/GNOME/glib/-/issues/2319
    https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E
    https://lists.debian.org/debian-lts-announce/2022/06/msg00006.html
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2REA7RVKN7ZHRLJOEGBRQKJIPZQPAELZ/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JJMPNDO4GDVURYQFYKFOWY5HAF4FTEPN/
    https://security.gentoo.org/glsa/202107-13
    https://security.netapp.com/advisory/ntap-20210319-0004/

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High