CVE-2020-35457

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

GNOME GLib before 2.65.3 has an integer overflow, that might lead to an out-of-bounds write, in g_option_group_add_entries. NOTE: the vendor's position is "Realistically this is not a security issue. The standard pattern is for callers to provide a static list of option entries in a fixed number of calls to g_option_group_add_entries()." The researcher states that this pattern is undocumented

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-190 CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Dec 14, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-354589.8An issue was discovered in ClusterLabs Hawk 2.x through 2.3.0-x. There is a Ruby shell code injection issue via the hawk_remember_me_id para CVE-2020-354597.8An issue was discovered in ClusterLabs crmsh through 4.2.1. Local attackers able to call "crm history" (when "crm" is run) were able to exec CVE-2020-35465.3A vulnerability in the web-based management interface of Cisco AsyncOS software for Cisco Email Security Appliance (ESA) could allow an unau CVE-2020-354605.3common/InputStreamHelper.java in Packwood MPXJ before 8.3.5 allows directory traversal in the zip stream handler flow, leading to the writin CVE-2020-354629.8Version 3.16.0 of the CoScale agent Docker image contains a blank password for the root user. Systems deployed using affected versions of th CVE-2020-354639.8Version 1.0.0 of the Instana Dynamic APM Docker image contains a blank password for the root user. Systems deployed using affected versions CVE-2020-354649.8Version 1.3.0 of the Weave Cloud Agent Docker image contains a blank password for the root user. Systems deployed using affected versions of CVE-2020-354669.8The Blackfire Docker image through 2020-12-14 contains a blank password for the root user. Systems deployed using affected versions of the B CVE-2020-354679.8The Docker Docs Docker image through 2020-12-14 contains a blank password for the root user. Systems deployed using affected versions of the CVE-2020-354689.8The Appbase streams Docker image 2.1.2 contains a blank password for the root user. Systems deployed using affected versions of the streams CVE-2020-354699.8The Software AG Terracotta Server OSS Docker image 5.4.1 contains a blank password for the root user. Systems deployed using affected versio CVE-2020-35476.5A vulnerability in the web-based management interface of Cisco AsyncOS software for Cisco Email Security Appliance (ESA), Cisco Content Secu