Описание
A flaw was found in GLib. GVariant deserialization fails to validate that the input conforms to the expected format, leading to denial of service.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| glib2.0 | fixed | 2.74.4-1 | package | |
| glib2.0 | fixed | 2.66.8-1+deb11u1 | bullseye | package |
Примечания
https://gitlab.gnome.org/GNOME/glib/-/issues/2794
https://gitlab.gnome.org/GNOME/glib/-/merge_requests/3125
https://gitlab.gnome.org/GNOME/glib/-/merge_requests/3126 (2.74, 3125 backport)
Merge commit for glib-2-74: https://gitlab.gnome.org/GNOME/glib/-/commit/e16fb83755e08a4c2da2b0a8ea0fc2e27b1154bf (2.74.4)
Be careful. Original fix introduces new bugs, resulting in CVE-2023-32643 and CVE-2023-32636
https://gitlab.gnome.org/GNOME/glib/-/issues/2840 (CVE-2023-32643)
https://gitlab.gnome.org/GNOME/glib/-/issues/2841 (CVE-2023-32636)
EPSS
Связанные уязвимости
A flaw was found in GLib. GVariant deserialization fails to validate that the input conforms to the expected format, leading to denial of service.
A flaw was found in GLib. GVariant deserialization fails to validate that the input conforms to the expected format, leading to denial of service.
A flaw was found in GLib. GVariant deserialization fails to validate that the input conforms to the expected format, leading to denial of service.
Gvariant offset table entry size is not checked in is_normal()
A flaw was found in GLib. GVariant deserialization fails to validate that the input conforms to the expected format, leading to denial of service.
EPSS