Summary
It was discovered that GLib incorrectly handled non-normal GVariants. An
attacker could use this issue to cause GLib to crash, resulting in a denial
of service, or perform other unknown attacks.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | glib2.0 | 2.64.6-1~ubuntu20.04.6 |
| Ubuntu · 22.04 LTS 22.04:LTS | glib2.0 | 2.72.4-0ubuntu2.2 |
Vulnerabilities 7
-
Medium 5.5
Gvariant offset table entry size is not checked in is_normal()
A flaw was found in GLib. GVariant deserialization fails to validate that the input conforms to the expected format, leading to denial of service.
-
Medium 5.5
G_variant_byteswap() can take a long time with some non-normal inputs
A flaw was found in GLib. GVariant deserialization is vulnerable to a slowdown issue where a crafted GVariant can cause excessive processing, leading to denial of service.
-
Medium 5.5
Gvariant deserialisation does not match spec for non-normal data
A flaw was found in GLib. GVariant deserialization is vulnerable to an exponential blowup issue where a crafted GVariant can cause excessive processing, leading to denial of service.
-
Medium 5.3
A flaw was found in GLib. The GVariant deserialization code is vulnerable to a heap buffer overflow introduced by the f…
-
Medium 4.7
A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by ad…
-
Unscored —
-
Unscored —
References
-
report
https://ubuntu.com/security/CVE-2023-24593
-
report
https://ubuntu.com/security/CVE-2023-25180
-
report
https://ubuntu.com/security/CVE-2023-29499
-
report
https://ubuntu.com/security/CVE-2023-32611
-
report
https://ubuntu.com/security/CVE-2023-32636
-
report
https://ubuntu.com/security/CVE-2023-32643
-
report
https://ubuntu.com/security/CVE-2023-32665