Description
A vulnerability was found in GNOME gvdb. It has been classified as critical. This affects the function gvdb_table_write_contents_async of the file gvdb-builder.c. The manipulation leads to use after free. It is possible to initiate the attack remotely. The name of the patch is d83587b2a364eb9a9a53be7e6a708074e252de14. It is recommended to apply a patch to fix this issue. The identifier VDB-216789 was assigned to this vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| GNOME | gvdb | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | epiphany-browser | 3.34.1-1 | — |
| Debian 14 | glib2.0 | 2.66.0-1 | — |
| Debian 13 | epiphany-browser | 3.34.1-1 | — |
| Debian 13 | glib2.0 | 2.66.0-1 | — |
| Debian 12 | epiphany-browser | 3.34.1-1 | — |
| Debian 12 | glib2.0 | 2.66.0-1 | — |
References
- https://vuldb.com/?id.216789 vdb-entry technical-description
- https://vuldb.com/?ctiid.216789 signature permissions-required
- https://github.com/GNOME/gvdb/commit/d83587b2a364eb9a9a53be7e6a708074e252de14 patch