CVE-2020-35457: 
NixOS vulnerability analysis and mitigation

GNOME GLib before version 2.65.3 contains an integer overflow vulnerability in the g_option_group_add_entries function that could potentially lead to an out-of-bounds write. The vulnerability was discovered and disclosed in December 2020. This issue is disputed, as the vendor maintains that it is not realistically a security concern, stating that the standard pattern involves callers providing a static list of option entries in a fixed number of calls (NVD, CVE).

The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH), with the following vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The issue is classified under CWE-787 (Out-of-bounds Write) and CWE-190 (Integer Overflow or Wraparound). The vulnerability specifically affects the g_option_group_add_entries function in the GLib library (NVD).

If exploited, this vulnerability could potentially lead to an out-of-bounds write condition, which might result in memory corruption. However, the practical impact is disputed by the vendor, who argues that the standard usage pattern of the affected function makes actual exploitation unlikely (NVD).

The vulnerability requires local access with low attack complexity and low privileges. While technically exploitable, the vendor disputes the practical exploitability due to the standard usage pattern of the affected function (NVD).

The vulnerability was fixed in GNOME GLib version 2.65.3. Users are recommended to upgrade to this version or later. The fix has been backported to various Linux distributions, including Debian which has addressed this in multiple package versions (Debian).