{"id":"CVE-2020-35457","aliases":["AZL-6435","BELL-CVE-2020-35457","CLSA-2025-1758705181","CLSA-2025-1758709468","CLSA-2025-1763023946","CLSA-2026-1777391919","CLSA-2026-1777392531","DEBIAN-CVE-2020-35457","EUVD-2020-23131","GHSA-2fcx-98cm-5x99","JLSEC-2025-155","OESA-2021-1106"],"status":"disputed","title":"** DISPUTED ** GNOME GLib before 2.65.3 has an integer overflow, that might lead to an out-of...","description":"GNOME GLib before 2.65.3 has an integer overflow, that might lead to an out-of-bounds write, in g_option_group_add_entries. NOTE: the vendor's position is \"Realistically this is not a security issue. The standard pattern is for callers to provide a static list of option entries in a fixed number of calls to g_option_group_add_entries().\" The researcher states that this pattern is undocumented","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00574,"percentile":0.47848,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190","CWE-787"],"published":"2020-12-14T22:25:09Z","modified":"2026-10-26T12:01:59Z","fixes":[{"ecosystem":"Azure Linux:2","package":"glib","fixed_in":["2.60.1-5"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"glib2","fixed_in":["2.28.8-12.el6.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"glib2-devel","fixed_in":["2.28.8-12.el6.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"glib2-doc","fixed_in":["2.28.8-12.el6.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"glib2-static","fixed_in":["2.28.8-12.el6.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"glib2","fixed_in":["2.28.8-12.el6.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"glib2-devel","fixed_in":["2.28.8-12.el6.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"glib2-doc","fixed_in":["2.28.8-12.el6.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"glib2-static","fixed_in":["2.28.8-12.el6.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"libglib2.0-0","fixed_in":["2.58.3-2+deb10u6+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"libglib2.0-bin","fixed_in":["2.58.3-2+deb10u6+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"libglib2.0-data","fixed_in":["2.58.3-2+deb10u6+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"libglib2.0-dev","fixed_in":["2.58.3-2+deb10u6+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"libglib2.0-dev-bin","fixed_in":["2.58.3-2+deb10u6+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"libglib2.0-doc","fixed_in":["2.58.3-2+deb10u6+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"libglib2.0-tests","fixed_in":["2.58.3-2+deb10u6+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"glib2","fixed_in":["2.56.4-156.el8.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"glib2-devel","fixed_in":["2.56.4-156.el8.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"glib2-doc","fixed_in":["2.56.4-156.el8.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"glib2-fam","fixed_in":["2.56.4-156.el8.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"glib2-static","fixed_in":["2.56.4-156.el8.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"glib2-tests","fixed_in":["2.56.4-156.el8.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"glib2","fixed_in":["2.56.4-156.el8.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"glib2-devel","fixed_in":["2.56.4-156.el8.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"glib2-doc","fixed_in":["2.56.4-156.el8.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"glib2-fam","fixed_in":["2.56.4-156.el8.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"glib2-static","fixed_in":["2.56.4-156.el8.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"glib2-tests","fixed_in":["2.56.4-156.el8.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"glib2.0","fixed_in":["2.66.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"glib2.0","fixed_in":["2.66.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"glib2.0","fixed_in":["2.66.0-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"Glib_jll","fixed_in":["2.68.1+0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"glib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.60.1-5"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.28.8-12.el6.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"glib2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.28.8-12.el6.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"glib2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.28.8-12.el6.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"glib2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.28.8-12.el6.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.28.8-12.el6.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"glib2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.28.8-12.el6.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"glib2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.28.8-12.el6.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"glib2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.28.8-12.el6.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libglib2.0-0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.58.3-2+deb10u6+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libglib2.0-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.58.3-2+deb10u6+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libglib2.0-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.58.3-2+deb10u6+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libglib2.0-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.58.3-2+deb10u6+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libglib2.0-dev-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.58.3-2+deb10u6+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libglib2.0-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.58.3-2+deb10u6+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libglib2.0-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.58.3-2+deb10u6+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-156.el8.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"glib2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-156.el8.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"glib2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-156.el8.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"glib2-fam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-156.el8.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"glib2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-156.el8.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"glib2-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-156.el8.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-156.el8.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"glib2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-156.el8.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"glib2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-156.el8.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"glib2-fam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-156.el8.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"glib2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-156.el8.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"glib2-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-156.el8.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"glib2.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.66.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"glib2.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.66.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"glib2.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.66.0-1"}]}]},{"source":"osv","ecosystem":"Julia","package":"Glib_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.68.1+0"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS","package":"glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.62.5-4.oe1"}]}],"bundled":3}],"products":[{"vendor":"gnome","product":"glib"}],"references":[{"url":"https://gitlab.gnome.org/GNOME/glib/-/commit/63c5b62f0a984fac9a9700b12f54fe878e016a5d","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix","web"]},{"url":"https://gitlab.gnome.org/GNOME/glib/-/issues/2197","tags":["x_refsource_MISC","x_transferred","Exploit","Vendor Advisory","evidence","web"]},{"url":"https://gitlab.gnome.org/GNOME/glib/-/releases/2.65.3","tags":["x_refsource_MISC","x_transferred","Release Notes","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-35457","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-2fcx-98cm-5x99"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2020-35457","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux6els/CLSA-2025-1758705181.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos6els/CLSA-2025-1758709468.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2025-1763023946.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.4els/CLSA-2026-1777391919.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.5els/CLSA-2026-1777392531.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-35457","tags":["advisory"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1106","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27218","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27219","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-35457","description":"GNOME GLib before 2.65.3 has an integer overflow, that might lead to an out-of-bounds write, in g_option_group_add_entries. NOTE: the vendor's position is \"Realistically this is not a security issue. The standard pattern is for callers to provide a static list of option entries in a fixed number of calls to g_option_group_add_entries().\" The researcher states that this pattern is undocumented","status":"disputed","published":"2020-12-14T22:25:09Z","modified":"2024-08-04T17:02:07.975Z","updated_at":"2026-11-02T14:35:57.975444Z"}],"euvd":[{"id":"EUVD-2020-23131","description":"GNOME GLib before 2.65.3 has an integer overflow, that might lead to an out-of-bounds write, in g_option_group_add_entries. NOTE: the vendor's position is \"Realistically this is not a security issue. The standard pattern is for callers to provide a static list of option entries in a fixed number of calls to g_option_group_add_entries().\" The researcher states that this pattern is undocumented","status":"published","published":"2020-12-14T22:25:09Z","modified":"2024-08-04T17:02:07Z","updated_at":"2026-11-03T03:07:06.389211Z"}],"ghsa":[{"id":"GHSA-2fcx-98cm-5x99","title":"** DISPUTED ** GNOME GLib before 2.65.3 has an integer overflow, that might lead to an out-of...","description":"** DISPUTED ** GNOME GLib before 2.65.3 has an integer overflow, that might lead to an out-of-bounds write, in g_option_group_add_entries. NOTE: the vendor's position is \"Realistically this is not a security issue. The standard pattern is for callers to provide a static list of option entries in a fixed number of calls to g_option_group_add_entries().\" The researcher states that this pattern is undocumented.","status":"published","published":"2022-05-24T17:36:36Z","modified":"2024-03-30T05:01:43Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:55:45.190481Z"}],"nvd":[{"id":"CVE-2020-35457","description":"GNOME GLib before 2.65.3 has an integer overflow, that might lead to an out-of-bounds write, in g_option_group_add_entries. NOTE: the vendor's position is \"Realistically this is not a security issue. The standard pattern is for callers to provide a static list of option entries in a fixed number of calls to g_option_group_add_entries().\" The researcher states that this pattern is undocumented","status":"disputed","published":"2020-12-14T23:15:12.173Z","modified":"2026-06-17T03:13:44.55Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-190","CWE-787"],"updated_at":"2026-11-02T14:06:27.73474Z"}],"osv":[{"id":"AZL-6435","title":"CVE-2020-35457 affecting package glib for versions less than 2.60.1-5","description":"GNOME GLib before 2.65.3 has an integer overflow, that might lead to an out-of-bounds write, in g_option_group_add_entries. NOTE: the vendor's position is \"Realistically this is not a security issue. The standard pattern is for callers to provide a static list of option entries in a fixed number of calls to g_option_group_add_entries().\" The researcher states that this pattern is undocumented","status":"published","published":"2020-12-14T23:15:12Z","modified":"2026-04-21T04:32:22.357914Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:07.805289Z"},{"id":"BELL-CVE-2020-35457","title":"CVE-2020-35457 does not affect BellSoft software","status":"withdrawn","published":"2020-12-14T23:15:00Z","modified":"2026-01-26T09:49:45.645489Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:15.925958Z"},{"id":"CVE-2020-35457","description":"GNOME GLib before 2.65.3 has an integer overflow, that might lead to an out-of-bounds write, in g_option_group_add_entries. NOTE: the vendor's position is \"Realistically this is not a security issue. The standard pattern is for callers to provide a static list of option entries in a fixed number of calls to g_option_group_add_entries().\" The researcher states that this pattern is undocumented","status":"published","published":"2020-12-14T23:15:12.173Z","modified":"2026-10-24T14:22:44.736758883Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:16.612899Z"},{"id":"DEBIAN-CVE-2020-35457","description":"GNOME GLib before 2.65.3 has an integer overflow, that might lead to an out-of-bounds write, in g_option_group_add_entries. NOTE: the vendor's position is \"Realistically this is not a security issue. The standard pattern is for callers to provide a static list of option entries in a fixed number of calls to g_option_group_add_entries().\" The researcher states that this pattern is undocumented","status":"published","published":"2020-12-14T23:15:12.173Z","modified":"2026-10-26T12:01:59.95896029Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:34.019707Z"},{"id":"JLSEC-2025-155","title":"GNOME GLib before 2.65.3 has an integer overflow, that might lead to an out-of-bounds write, in...","description":"GNOME GLib before 2.65.3 has an integer overflow, that might lead to an out-of-bounds write, in `g_option_group_add_entries`. NOTE: the vendor's position is \"Realistically this is not a security issue. The standard pattern is for callers to provide a static list of option entries in a fixed number of calls to `g_option_group_add_entries()`.\" The researcher states that this pattern is undocumented","status":"published","published":"2025-10-19T22:31:43.957Z","modified":"2026-07-23T22:30:11.926220267Z","cvss":[{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:17.805107Z"},{"id":"OESA-2021-1106","title":"glib2 security update","description":"GLib is a bundle of three (formerly five) low-level system libraries written in C and developed mainly by GNOME. GLib\u0026apos;s code was separated from GTK, so it can be used by software other than GNOME and has been developed in parallel ever since.\r\n\r\nSecurity Fix(es):\r\n\r\nAn issue was discovered in GNOME GLib before 2.66.7 and 2.67.x before 2.67.4. If g_byte_array_new_take() was called with a buffer of 4GB or more on a 64-bit platform, the length would be truncated modulo 2**32, causing unintended length truncation.(CVE-2021-27218)\r\n\r\nAn issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3. The function g_bytes_new has an integer overflow on 64-bit platforms due to an implicit cast from 64 bits to 32 bits. The overflow could potentially lead to memory corruption.(CVE-2021-27219)\n\n** DISPUTED ** GNOME GLib before 2.65.3 has an integer overflow, that might lead to an out-of-bounds write, in g_option_group_add_entries. NOTE: the vendor's position is \"Realistically this is not a security issue. The standard pattern is for callers to provide a static list of option entries in a fixed number of calls to g_option_group_add_entries().\" The researcher states that this pattern is undocumented.(CVE-2020-35457)","status":"published","published":"2021-04-07T11:04:20Z","modified":"2026-08-18T01:15:10.310987026Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"CLSA-2025-1758705181","title":"glib2: Fix of CVE-2020-35457","description":"- CVE-2020-35457: fix integer overflow in g_option_group_add_entries to prevent\n  potential out-of-bounds write\n- Bug775510: avoid calling Standard C string/array functions with NULL arguments","status":"published","published":"2025-09-24T09:13:04Z","modified":"2026-06-01T00:33:25.857933166Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"CLSA-2025-1758709468","title":"glib2: Fix of CVE-2020-35457","description":"- CVE-2020-35457: fix integer overflow in g_option_group_add_entries to prevent\n  potential out-of-bounds write\n- Bug775510: avoid calling Standard C string/array functions with NULL arguments","status":"published","published":"2025-09-24T10:24:32Z","modified":"2026-06-01T00:33:16.538945429Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"CLSA-2025-1763023946","title":"Fix CVE(s): CVE-2020-35457","description":"   * SECURITY UPDATE: Integer Overflow in g_option_group_add_entries\n     - debian/patches/CVE-2020-35457.patch: goption: add a precondition to\n       avoid GOptionEntry list overflow\n     - CVE-2020-35457","status":"published","published":"2025-11-13T08:52:30Z","modified":"2026-06-04T10:04:17.384234Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"CLSA-2026-1777391919","title":"glib2: Fix of CVE-2020-35457","description":"- CVE-2020-35457: add a precondition in g_option_group_add_entries() to\n  avoid a GOptionEntry list size overflow (GMAXSIZE). Patch backported\n  from amazon-linux-2els.","status":"published","published":"2026-04-28T15:58:44Z","modified":"2026-06-01T00:32:01.08055939Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1777392531","title":"glib2: Fix of CVE-2020-35457","description":"- CVE-2020-35457: add a precondition in g_option_group_add_entries() to\n  avoid a GOptionEntry list size overflow (GMAXSIZE). Patch backported\n  from amazon-linux-2els.","status":"published","published":"2026-04-28T16:08:56Z","modified":"2026-06-01T00:33:23.513464188Z","updated_at":"2026-11-02T15:43:44.384419Z"}]}}