ALT-PU-2025-10191-3

Package update glib2 in branch sisyphus

Version2.84.4-alt1

Published2026-04-15

Max severityHIGH

Severity:

Closed issues (4)

LOW3.7

Уязвимость набора библиотек GLib, связанная с целочисленным переполнением, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2025-10-06Modified: 2026-04-16

CVSS 3.xLOW 3.7

CVSS:3.x/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

CVSS 2.0LOW 2.6

CVSS:2.0/AV:N/AC:H/Au:N/C:N/I:N/A:P

References

CVE-2025-6052

LOW3.7

Уязвимость набора библиотек GLib, связанная с неверным ограничением имени пути к каталогу, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

Published: 2026-04-14Modified: 2026-04-20

CVSS 3.xLOW 3.7

CVSS:3.x/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

CVSS 2.0LOW 2.6

CVSS:2.0/AV:N/AC:H/Au:N/C:N/I:P/A:N

References

CVE-2025-7039

HIGH7.5

A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn’t. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corruption.

Published: 2025-06-13Modified: 2025-08-20

CVSS 3.xHIGH 7.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

LOW3.7

A flaw was found in glib. An integer overflow during temporary file creation leads to an out-of-bounds memory access, allowing an attacker to potentially perform path traversal or access private temporary file content by creating symbolic links. This vulnerability allows a local attacker to manipulate file paths and access unauthorized data. The core issue stems from insufficient validation of file path lengths during temporary file operations.

Published: 2025-09-03Modified: 2026-04-15

CVSS 3.xLOW 3.7

CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

References