Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-6052: A flaw was found in how GLib's GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn't. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corruption. CVE-2025-3360: A flaw was found in GLib. An integer overflow and buffer under-read occur when parsing a long invalid ISO 8601 timestamp with the g_date_time_new_from_iso8601() function.
Fixed packages 9
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | glib2 | 0:2.82.2-766.amzn2023 |
| Amazon Linux · 2023 | glib2-debuginfo | 0:2.82.2-766.amzn2023 |
| Amazon Linux · 2023 | glib2-debugsource | 0:2.82.2-766.amzn2023 |
| Amazon Linux · 2023 | glib2-devel | 0:2.82.2-766.amzn2023 |
| Amazon Linux · 2023 | glib2-devel-debuginfo | 0:2.82.2-766.amzn2023 |
| Amazon Linux · 2023 | glib2-doc | 0:2.82.2-766.amzn2023 |
| Amazon Linux · 2023 | glib2-static | 0:2.82.2-766.amzn2023 |
| Amazon Linux · 2023 | glib2-tests | 0:2.82.2-766.amzn2023 |
| Amazon Linux · 2023 | glib2-tests-debuginfo | 0:2.82.2-766.amzn2023 |
Vulnerabilities 2
-
Low 3.7
Glibc: glib prior to 2.82.5 is vulnerable to integer overflow and buffer under-read when parsing a very long invalid iso 8601 timestamp with g_date_time_new_from_iso8601().
A flaw was found in GLib. An integer overflow and buffer under-read occur when parsing a long invalid ISO 8601 timestamp with the g_date_time_new_from_iso8601() function.
-
Low 3.7
Glib: integer overflow in g_string_maybe_expand() leading to potential buffer overflow in glib gstring
A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it do…