Fixed packages 17
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 9 enterprise_linux:9::appstream | glib2-debuginfo | 0:2.68.4-11.el9 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | glib2-debugsource | 0:2.68.4-11.el9 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | glib2-devel | 0:2.68.4-11.el9 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | glib2-devel-debuginfo | 0:2.68.4-11.el9 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | glib2-doc | 0:2.68.4-11.el9 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | glib2-tests | 0:2.68.4-11.el9 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | glib2-tests-debuginfo | 0:2.68.4-11.el9 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | glib2 | 0:2.68.4-11.el9 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | glib2-debuginfo | 0:2.68.4-11.el9 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | glib2-debugsource | 0:2.68.4-11.el9 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | glib2-devel-debuginfo | 0:2.68.4-11.el9 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | glib2-tests-debuginfo | 0:2.68.4-11.el9 |
| Red Hat · RHEL 9 enterprise_linux:9::crb | glib2-debuginfo | 0:2.68.4-11.el9 |
| Red Hat · RHEL 9 enterprise_linux:9::crb | glib2-debugsource | 0:2.68.4-11.el9 |
| Red Hat · RHEL 9 enterprise_linux:9::crb | glib2-devel-debuginfo | 0:2.68.4-11.el9 |
| Red Hat · RHEL 9 enterprise_linux:9::crb | glib2-static | 0:2.68.4-11.el9 |
| Red Hat · RHEL 9 enterprise_linux:9::crb | glib2-tests-debuginfo | 0:2.68.4-11.el9 |
Vulnerabilities 3
-
Medium 5.5
Gvariant offset table entry size is not checked in is_normal()
A flaw was found in GLib. GVariant deserialization fails to validate that the input conforms to the expected format, leading to denial of service.
-
Medium 5.5
G_variant_byteswap() can take a long time with some non-normal inputs
A flaw was found in GLib. GVariant deserialization is vulnerable to a slowdown issue where a crafted GVariant can cause excessive processing, leading to denial of service.
-
Medium 5.5
Gvariant deserialisation does not match spec for non-normal data
A flaw was found in GLib. GVariant deserialization is vulnerable to an exponential blowup issue where a crafted GVariant can cause excessive processing, leading to denial of service.
References
-
article
https://access.redhat.com/security/updates/classification/#low
-
article
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.3_release_notes/index
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2211827
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2211828
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2211829
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2217771
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_6631.json
-
report
https://access.redhat.com/security/cve/CVE-2023-29499
-
advisory
https://www.cve.org/CVERecord?id=CVE-2023-29499
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-29499
-
article
https://gitlab.gnome.org/GNOME/glib/-/issues/2794
-
report
https://access.redhat.com/security/cve/CVE-2023-32611
-
advisory
https://www.cve.org/CVERecord?id=CVE-2023-32611
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-32611
-
article
https://gitlab.gnome.org/GNOME/glib/-/issues/2797
-
report
https://access.redhat.com/security/cve/CVE-2023-32665
-
advisory
https://www.cve.org/CVERecord?id=CVE-2023-32665
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-32665
-
article
https://gitlab.gnome.org/GNOME/glib/-/issues/2121