Red Hat Security Advisory: mingw-glib2 security update

Fixed packages 7

Vulnerabilities 4

• Medium 5.5
  CVE-2023-29499

  Gvariant offset table entry size is not checked in is_normal()

  A flaw was found in GLib. GVariant deserialization fails to validate that the input conforms to the expected format, leading to denial of service.

  Red Hat Fedora Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Linux Debian Ubuntu Azure Linux
  Sep 14, 2023
• Medium 5.5
  CVE-2023-32611

  G_variant_byteswap() can take a long time with some non-normal inputs

  A flaw was found in GLib. GVariant deserialization is vulnerable to a slowdown issue where a crafted GVariant can cause excessive processing, leading to denial of service.

  Red Hat Fedora Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Linux Debian Ubuntu Azure Linux
  Sep 14, 2023
• Medium 5.5
  CVE-2023-32665

  Gvariant deserialisation does not match spec for non-normal data

  A flaw was found in GLib. GVariant deserialization is vulnerable to an exponential blowup issue where a crafted GVariant can cause excessive processing, leading to denial of service.

  Red Hat Fedora Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Linux Debian Ubuntu Azure Linux
  Sep 14, 2023
• Medium 4.7
  CVE-2023-32636

  A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by ad…

  glib glib glib2.0 glib Ubuntu Azure Linux
  Sep 14, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#low
• article
  https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.4_release_notes/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2211827
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2211828
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2211829
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2211833
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2528.json
• report
  https://access.redhat.com/security/cve/CVE-2023-29499
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-29499
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-29499
• article
  https://gitlab.gnome.org/GNOME/glib/-/issues/2794
• report
  https://access.redhat.com/security/cve/CVE-2023-32611
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-32611
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-32611
• article
  https://gitlab.gnome.org/GNOME/glib/-/issues/2797
• report
  https://access.redhat.com/security/cve/CVE-2023-32636
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-32636
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-32636
• article
  https://discourse.gnome.org/t/multiple-fixes-for-gvariant-normalisation-issues-in-glib/12835
• article
  https://gitlab.gnome.org/GNOME/glib/-/issues/2841
• report
  https://access.redhat.com/security/cve/CVE-2023-32665
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-32665
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-32665
• article
  https://gitlab.gnome.org/GNOME/glib/-/issues/2121