A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file on little-endian systems when an attacker-controlled MIME magic file in a user-writable XDG data location (e.g., in the $XDG_DATA_HOME/mime/magic path) is parsed by an application performing MIME type detection (e.g., via g_content_type_guess()). When performing byte-swap, incorrect pointer arithmetic on the write side causes an out-of-bounds write of 2 bytes, resulting in an application crash or memory corruption.
2.68.4-1ubuntu12.70.1-12.70.2-12.71.0-22.71.1-12.71.2-12.71.3-12.72.0-12.72.1-12.72.4-0ubuntu1+9 more2.78.0-22.78.1-42.78.3-12.78.3-22.79.1-12.79.2-1~ubuntu12.79.3-3ubuntu52.80.0-6ubuntu12.80.0-6ubuntu32.80.0-6ubuntu3.1+6 more2.86.0-22.86.1-12.86.1-22.86.2-12.86.3-12.86.3-42.87.2-22.87.2-32.87.3-12.88.0-12.38.0-1ubuntu12.38.1-12.39.1-0ubuntu12.39.1-0ubuntu22.39.1-0ubuntu32.39.2-0ubuntu12.39.2-0ubuntu22.39.3-0ubuntu42.39.4-0ubuntu12.39.90-0ubuntu1+14 more2.46.1-12.46.1-22.47.1-12.47.3-32.47.4-12.47.5-12.47.6-12.48.0-1ubuntu32.48.0-1ubuntu42.48.1-1~ubuntu16.04.1+15 more2.54.1-1ubuntu12.55.2-2ubuntu12.56.0-2ubuntu12.56.0-4ubuntu12.56.1-2ubuntu12.56.2-0ubuntu0.18.04.12.56.2-0ubuntu0.18.04.22.56.3-0ubuntu0.18.04.12.56.4-0ubuntu0.18.04.22.56.4-0ubuntu0.18.04.3+9 more2.62.1-12.63.1-22.63.1-2ubuntu12.63.3-12.63.3-32.63.5-22.64.0-12.64.1-12.64.2-1~fakesync12.64.3-1~ubuntu20.04.1+9 moreExploitability
AV:LAC:LPR:NUI:RScope
S:UImpact
C:NI:HA:HCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H