GNOME Glade up to 3.38.0/3.39.x GladeGtkBox glade-gtk-box.c denial of service

Summaryinfo

A vulnerability identified as problematic has been detected in GNOME Glade up to 3.38.0/3.39.x. The affected element is an unknown function of the file plugins/gtk+/glade-gtk-box.c of the component GladeGtkBox. This manipulation causes denial of service. This vulnerability is registered as CVE-2020-36774. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in GNOME Glade up to 3.38.0/3.39.x. It has been declared as problematic. Affected by this vulnerability is some unknown functionality of the file plugins/gtk+/glade-gtk-box.c of the component GladeGtkBox. The manipulation with an unknown input leads to a denial of service vulnerability. The CWE definition for the vulnerability is CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. As an impact it is known to affect availability. The summary by CVE is:

plugins/gtk+/glade-gtk-box.c in GNOME Glade before 3.38.1 and 3.39.x before 3.40.0 mishandles widget rebuilding for GladeGtkBox, leading to a denial of service (application crash).

The weakness was published 02/19/2024 as 479. It is possible to read the advisory at gitlab.gnome.org. This vulnerability is known as CVE-2020-36774 since 02/19/2024. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 3.38.1 or 3.40.0 eliminates this vulnerability. Applying the patch 7acdd3c6f6934f47b8974ebc2190a59ea5d2ed17 is able to eliminate this problem. The bugfix is ready for download at gitlab.gnome.org. The best possible mitigation is suggested to be upgrading to the latest version.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• GNOME

Name

• Glade

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9
• 3.10
• 3.11
• 3.12
• 3.13
• 3.14
• 3.15
• 3.16
• 3.17
• 3.18
• 3.19
• 3.20
• 3.21
• 3.22
• 3.23
• 3.24
• 3.25
• 3.26
• 3.27
• 3.28
• 3.29
• 3.30
• 3.31
• 3.32
• 3.33
• 3.34
• 3.35
• 3.36
• 3.37
• 3.38
• 3.38.0
• 3.39

License

• open-source

Website

• Vendor: https://www.gnome.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion