Summary
USN-6165-1 fixed vulnerabilities in GLib. This update provides the
corresponding updates for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu
18.04 LTS.
Original advisory details:
It was discovered that GLib incorrectly handled non-normal GVariants. An
attacker could use this issue to cause GLib to crash, resulting in a
denial of service, or perform other unknown attacks.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | glib2.0 | 2.40.2-0ubuntu1.1+esm6 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | glib2.0 | 2.48.2-0ubuntu4.8+esm3 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | glib2.0 | 2.56.4-0ubuntu0.18.04.9+esm3 |
Vulnerabilities 5
-
Medium 5.5
Gvariant offset table entry size is not checked in is_normal()
A flaw was found in GLib. GVariant deserialization fails to validate that the input conforms to the expected format, leading to denial of service.
-
Medium 5.5
G_variant_byteswap() can take a long time with some non-normal inputs
A flaw was found in GLib. GVariant deserialization is vulnerable to a slowdown issue where a crafted GVariant can cause excessive processing, leading to denial of service.
-
Medium 5.5
Gvariant deserialisation does not match spec for non-normal data
A flaw was found in GLib. GVariant deserialization is vulnerable to an exponential blowup issue where a crafted GVariant can cause excessive processing, leading to denial of service.
-
Medium 5.3
A flaw was found in GLib. The GVariant deserialization code is vulnerable to a heap buffer overflow introduced by the f…
-
Medium 4.7
A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by ad…