All errata/sisyphus/ALT-PU-2025-15521-4
ALT-PU-2025-15521-4

Package update glib2 in branch sisyphus

Version2.86.3-alt1
Task#402304
Published2026-04-14
Max severityCRITICAL
Severity:

Closed issues (6)

BDU:2026-02745
HIGH7.7

Уязвимость функции g_escape_uri_string() набора библиотек GLib, позволяющая нарушителю нарушить целостность данных, а также вызвать отказ в обслуживании

Published: 2026-03-10Modified: 2026-04-20
CVSS 3.xHIGH 7.7
CVSS:3.x/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS 2.0MEDIUM 6.6
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:C/A:C
References
BDU:2026-02750
MEDIUM6.5

Уязвимость функции escape_byte_string() компонента gio/gfileattribute.c набора библиотек GLib, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2026-03-10Modified: 2026-04-20
CVSS 3.xMEDIUM 6.5
CVSS:3.x/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0HIGH 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:C
References
BDU:2026-05069
MEDIUM5.6

Уязвимость функций bytestring_parse() и string_parse() набора библиотек GLib, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2026-04-13Modified: 2026-04-20
CVSS 3.xMEDIUM 5.6
CVSS:3.x/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS 2.0MEDIUM 5.1
CVSS:2.0/AV:N/AC:H/Au:N/C:P/I:P/A:P
References
CVE-2025-13601
HIGH7.7

A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable characters (which would need escaping), the calculation of the length of the escaped string could overflow, leading to a potential write off the end of the newly allocated string.

Published: 2025-11-26Modified: 2026-04-19
CVSS 3.xHIGH 7.7
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
References
CVE-2025-14087
CRITICAL9.8

A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause heap corruption, leading to a denial of service or potential code execution via a buffer-underflow in the GVariant parser when processing maliciously crafted input strings.

Published: 2025-12-10Modified: 2026-04-19
CVSS 3.xCRITICAL 9.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
CVE-2025-14512
MEDIUM6.5

A flaw was found in glib. This vulnerability allows a heap buffer overflow and denial-of-service (DoS) via an integer overflow in GLib's GIO (GLib Input/Output) escape_byte_string() function when processing malicious file or remote filesystem attribute values.

Published: 2025-12-11Modified: 2026-04-19
CVSS 3.xMEDIUM 6.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
References