Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2025:4441-1

Опубликовано: 17 дек. 2025
Источник: suse-cvrf

Описание

Security update for glib2

This update for glib2 fixes the following issues:

  • CVE-2025-14512: integer overflow in the GIO escape_byte_string() function when processing malicious files or remote filesystem attribute values can lead to denial-of-service (bsc#1254878).
  • CVE-2025-14087: buffer underflow in the GVariant parser bytestring_parse() and string_parse() functions when processing attacker-influenced data may lead to crash or code execution (bsc#1254662).
  • CVE-2025-13601: heap-based buffer overflow in the g_escape_uri_string() function when processing strings with a large number of unacceptable characters may lead to crash or code execution (bsc#1254297).

Список пакетов

SUSE Linux Enterprise Server 12 SP5-LTSS
glib2-devel-2.48.2-12.52.1
glib2-devel-static-2.48.2-12.52.1
glib2-lang-2.48.2-12.52.1
glib2-tools-2.48.2-12.52.1
libgio-2_0-0-2.48.2-12.52.1
libgio-2_0-0-32bit-2.48.2-12.52.1
libglib-2_0-0-2.48.2-12.52.1
libglib-2_0-0-32bit-2.48.2-12.52.1
libgmodule-2_0-0-2.48.2-12.52.1
libgmodule-2_0-0-32bit-2.48.2-12.52.1
libgobject-2_0-0-2.48.2-12.52.1
libgobject-2_0-0-32bit-2.48.2-12.52.1
libgthread-2_0-0-2.48.2-12.52.1
libgthread-2_0-0-32bit-2.48.2-12.52.1
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5
glib2-devel-2.48.2-12.52.1
glib2-devel-static-2.48.2-12.52.1
glib2-lang-2.48.2-12.52.1
glib2-tools-2.48.2-12.52.1
libgio-2_0-0-2.48.2-12.52.1
libgio-2_0-0-32bit-2.48.2-12.52.1
libglib-2_0-0-2.48.2-12.52.1
libglib-2_0-0-32bit-2.48.2-12.52.1
libgmodule-2_0-0-2.48.2-12.52.1
libgmodule-2_0-0-32bit-2.48.2-12.52.1
libgobject-2_0-0-2.48.2-12.52.1
libgobject-2_0-0-32bit-2.48.2-12.52.1
libgthread-2_0-0-2.48.2-12.52.1
libgthread-2_0-0-32bit-2.48.2-12.52.1

Ссылки

Описание

A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable characters (which would need escaping), the calculation of the length of the escaped string could overflow, leading to a potential write off the end of the newly allocated string.

Затронутые продукты
SUSE Linux Enterprise Server 12 SP5-LTSS:glib2-devel-2.48.2-12.52.1
SUSE Linux Enterprise Server 12 SP5-LTSS:glib2-devel-static-2.48.2-12.52.1
SUSE Linux Enterprise Server 12 SP5-LTSS:glib2-lang-2.48.2-12.52.1
SUSE Linux Enterprise Server 12 SP5-LTSS:glib2-tools-2.48.2-12.52.1
Ссылки

Описание

A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause heap corruption, leading to a denial of service or potential code execution via a buffer-underflow in the GVariant parser when processing maliciously crafted input strings.

Затронутые продукты
SUSE Linux Enterprise Server 12 SP5-LTSS:glib2-devel-2.48.2-12.52.1
SUSE Linux Enterprise Server 12 SP5-LTSS:glib2-devel-static-2.48.2-12.52.1
SUSE Linux Enterprise Server 12 SP5-LTSS:glib2-lang-2.48.2-12.52.1
SUSE Linux Enterprise Server 12 SP5-LTSS:glib2-tools-2.48.2-12.52.1
Ссылки

Описание

A flaw was found in glib. This vulnerability allows a heap buffer overflow and denial-of-service (DoS) via an integer overflow in GLib's GIO (GLib Input/Output) escape_byte_string() function when processing malicious file or remote filesystem attribute values.

Затронутые продукты
SUSE Linux Enterprise Server 12 SP5-LTSS:glib2-devel-2.48.2-12.52.1
SUSE Linux Enterprise Server 12 SP5-LTSS:glib2-devel-static-2.48.2-12.52.1
SUSE Linux Enterprise Server 12 SP5-LTSS:glib2-lang-2.48.2-12.52.1
SUSE Linux Enterprise Server 12 SP5-LTSS:glib2-tools-2.48.2-12.52.1
Ссылки