Summary
[2.78.0-1]
- Bump glib2 version 2.78.0
- Drop DesktopQE gating
- Fix CVEs: CVE-2023-32636, CVE-2023-29499, CVE-2023-32611, CVE-2023-32665, DoS
- Resolves: RHEL-5019
- Resolves: RHEL-5020
- Resolves: RHEL-5092
- Resolves: RHEL-5093
- Resolves: RHEL-5094
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | mingw32-glib2 | 0:2.78.0-1.el9 |
| Oracle Linux · 9 | mingw32-glib2-static | 0:2.78.0-1.el9 |
| Oracle Linux · 9 | mingw64-glib2 | 0:2.78.0-1.el9 |
| Oracle Linux · 9 | mingw64-glib2-static | 0:2.78.0-1.el9 |
Vulnerabilities 4
-
Medium 5.5
Gvariant offset table entry size is not checked in is_normal()
A flaw was found in GLib. GVariant deserialization fails to validate that the input conforms to the expected format, leading to denial of service.
-
Medium 5.5
G_variant_byteswap() can take a long time with some non-normal inputs
A flaw was found in GLib. GVariant deserialization is vulnerable to a slowdown issue where a crafted GVariant can cause excessive processing, leading to denial of service.
-
Medium 5.5
Gvariant deserialisation does not match spec for non-normal data
A flaw was found in GLib. GVariant deserialization is vulnerable to an exponential blowup issue where a crafted GVariant can cause excessive processing, leading to denial of service.
-
Medium 4.7
A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by ad…