Package "libglib2.0-0"
| Name: |
libglib2.0-0
|
Description: |
GLib library of C routines
|
| Latest version: |
2.72.4-0ubuntu2.10 |
| Release: |
jammy (22.04) |
| Level: |
security |
| Repository: |
main |
| Head package: |
glib2.0 |
| Homepage: |
https://wiki.gnome.org/Projects/GLib |
Links
Download "libglib2.0-0"
Other versions of "libglib2.0-0" in Jammy
Changelog
|
glib2.0 (2.72.4-0ubuntu2.10) jammy-security; urgency=medium
* SECURITY UPDATE: off-by-one OOB read in GVariant serialiser
- debian/patches/CVE-2026-58010.patch: fix bounds check to use >= instead
of > in gvs_tuple_is_normal() in glib/gvariant-serialiser.c.
- CVE-2026-58010
* SECURITY UPDATE: OOB read in GDateTime
- debian/patches/CVE-2026-58011.patch: add missing range validation to
g_date_time_add_full() in glib/gdatetime.c.
- CVE-2026-58011
* SECURITY UPDATE: buffer over-read in g_regex_replace
- debian/patches/CVE-2026-58012.patch: fix case-change substitution
handling with G_REGEX_RAW in glib/gregex.c.
- CVE-2026-58012
* SECURITY UPDATE: buffer over-read in GIOChannel
- debian/patches/CVE-2026-58013.patch: add length check before memcmp
in g_io_channel_read_line_backend() in glib/giochannel.c.
- CVE-2026-58013
* SECURITY UPDATE: off-by-one heap under-read in GKeyFile
- debian/patches/CVE-2026-58014.patch: add len > 0 check before
accessing value[len-1] in g_key_file_get_locale_string_list() in
glib/gkeyfile.c.
- CVE-2026-58014
* SECURITY UPDATE: path traversal in DBUS_COOKIE_SHA1 auth
- debian/patches/CVE-2026-58015.patch: validate cookie_context parameter
to prevent path traversal in gio/gdbusauthmechanismsha1.c.
- CVE-2026-58015
* SECURITY UPDATE: state confusion in D-Bus introspection XML parser
- debian/patches/CVE-2026-58016.patch: fix node element nesting check
and add assertions in gio/gdbusintrospection.c.
- CVE-2026-58016
* SECURITY UPDATE: resource exhaustion in GDBus authentication
- debian/patches/CVE-2026-15588.patch: limit length of lines read from
client in gio/gdbusauth.c.
- CVE-2026-15588
* SECURITY UPDATE: heap buffer overflow in xdgmime
- debian/patches/CVE-2026-16118.patch: fix pointer arithmetic in
byte-swap routine in gio/xdgmime/xdgmimemagic.c.
- CVE-2026-16118
-- Leonidas Da Silva Barbosa Tue, 08 Sep 2026 14:07:49 -0300
|
| Source diff to previous version |
| CVE-2026-58010 |
A flaw was found in GLib. An off-by-one error can occur in the gvs_tuple_is_normal function in the glib/gvariant-serialiser.c file when doing an alig |
| CVE-2026-58011 |
A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the g_date_time_get_ymd function in the glib/gdatetime.c file when an in |
| CVE-2026-58012 |
A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when used with the `G_REGEX_RAW` compile flag and case-change |
| CVE-2026-58013 |
A flaw was found in GLib. A buffer over-read can occur in g_io_channel_read_line_backend() in the giochannel.c file when a custom line terminator wit |
| CVE-2026-58014 |
A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key f |
| CVE-2026-58015 |
A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_con |
| CVE-2026-58016 |
A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malfo |
| CVE-2026-15588 |
A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib. The `gdbusauth` authentication mechanism fails |
| CVE-2026-16118 |
A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file on little |
|
|
glib2.0 (2.72.4-0ubuntu2.9) jammy-security; urgency=medium
* SECURITY UPDATE: integer overflow in Base64 encoding
- debian/patches/CVE-2026-1484-1.patch: use gsize to prevent potential
overflow in glib/gbase64.c.
- debian/patches/CVE-2026-1484-2.patch: ensure that the out value is
within allocated size in glib/gbase64.c.
- CVE-2026-1484
* SECURITY UPDATE: buffer underflow via header length
- debian/patches/CVE-2026-1485.patch: do not overflow if header is
longer than MAXINT in gio/gcontenttype.c.
- CVE-2026-1485
* SECURITY UPDATE: integer overflow via Unicode case conversion
- debian/patches/CVE-2026-1489-1.patch: use size_t for output_marks
length in glib/guniprop.c.
- debian/patches/CVE-2026-1489-2.patch: do not convert size_t to gint
in glib/guniprop.c.
- debian/patches/CVE-2026-1489-3.patch: ensure we do not overflow size
in glib/guniprop.c.
- debian/patches/CVE-2026-1489-4.patch: add test debug information when
parsing input files in glib/tests/unicode.c.
- CVE-2026-1489
-- Marc Deslauriers <email address hidden> Wed, 28 Jan 2026 12:57:54 -0500
|
| Source diff to previous version |
| CVE-2026-1484 |
A flaw was found in the GLib Base64 encoding routine when processing very large input data. Due to incorrect use of integer types during length calcu |
| CVE-2026-1485 |
A flaw was found in Glib's content type parsing logic. This buffer underflow vulnerability occurs because the length of a header line is stored in a |
| CVE-2026-1489 |
A flaw was found in GLib. An integer overflow vulnerability in its Unicode case conversion implementation can lead to memory corruption. By processin |
|
|
glib2.0 (2.72.4-0ubuntu2.8) jammy-security; urgency=medium
* SECURITY UPDATE: Integer overflow in g_buffered_input_stream_peek()
- debian/patches/CVE-2026-0988.patch: fix a potential integer overflow
in peek() in gio/gbufferedinputstream.c,
gio/tests/buffered-input-stream.c.
- CVE-2026-0988
-- Marc Deslauriers <email address hidden> Tue, 20 Jan 2026 08:55:03 -0500
|
| Source diff to previous version |
|
glib2.0 (2.72.4-0ubuntu2.7) jammy-security; urgency=medium
* SECURITY UPDATE: overflow via long invalid ISO 8601 timestamp
- debian/patches/CVE-2025-3360-1.patch: fix integer overflow when
parsing very long ISO8601 inputs in glib/gdatetime.c.
- debian/patches/CVE-2025-3360-2.patch: fix potential integer overflow
in timezone offset handling in glib/gdatetime.c.
- debian/patches/CVE-2025-3360-3.patch: track timezone length as an
unsigned size_t in glib/gdatetime.c.
- debian/patches/CVE-2025-3360-4.patch: factor out some string pointer
arithmetic in glib/gdatetime.c.
- debian/patches/CVE-2025-3360-5.patch: factor out an undersized
variable in glib/gdatetime.c.
- debian/patches/CVE-2025-3360-6.patch: add some missing GDateTime
ISO8601 parsing tests in glib/tests/gdatetime.c.
- CVE-2025-3360
* SECURITY UPDATE: GString overflow
- debian/patches/CVE-2025-6052.patch: fix overflow check when expanding
the string in glib/gstring.c.
- CVE-2025-6052
* SECURITY UPDATE: integer overflow in temp file creation
- debian/patches/CVE-2025-7039.patch: fix computation of temporary file
name in glib/gfileutils.c.
- CVE-2025-7039
* SECURITY UPDATE: heap overflow in g_escape_uri_string()
- debian/patches/CVE-2025-13601.patch: add overflow check in
glib/gconvert.c.
- CVE-2025-13601
* SECURITY UPDATE: buffer underflow through glib/gvariant
- debian/patches/CVE-2025-14087-1.patch: fix potential integer overflow
parsing (byte)strings in glib/gvariant-parser.c.
- debian/patches/CVE-2025-14087-2.patch: use size_t to count numbers of
child elements in glib/gvariant-parser.c.
- debian/patches/CVE-2025-14087-3.patch: convert error handling code to
use size_t in glib/gvariant-parser.c.
- CVE-2025-14087
* SECURITY UPDATE: integer overflow in gfileattribute
- debian/patches/gfileattribute-overflow.patch: add overflow check in
gio/gfileattribute.c.
- No CVE number
-- Marc Deslauriers <email address hidden> Wed, 10 Dec 2025 11:09:12 -0500
|
| Source diff to previous version |
| CVE-2025-3360 |
A flaw was found in GLib. An integer overflow and buffer under-read occur when parsing a long invalid ISO 8601 timestamp with the g_date_time_new_fro |
| CVE-2025-6052 |
A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input ca |
| CVE-2025-7039 |
A flaw was found in glib. An integer overflow during temporary file creation leads to an out-of-bounds memory access, allowing an attacker to potenti |
| CVE-2025-13601 |
A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the |
| CVE-2025-14087 |
A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause heap corruption, leading to a denial of service or potenti |
|
|
glib2.0 (2.72.4-0ubuntu2.5) jammy-security; urgency=medium
* SECURITY UPDATE: Integer Overflow
- debian/patches/CVE-2025-4373-1.patch: carefully handle gssize
in glib/gstring.c.
- debian/patches/CVE-2025-4373-2.patch: make len_unsigned
unsigned in glib/gstring.c
- CVE-2025-4373
-- Leonidas Da Silva Barbosa <email address hidden> Mon, 12 May 2025 05:34:39 -0300
|
| CVE-2025-4373 |
A flaw was found in GLib, which is vulnerable to an integer overflow in the g_string_insert_unichar() function. When the position at which to insert |
|
About
-
Send Feedback to @ubuntu_updates
