Description
Multiple integer overflows in glib/gbase64.c in GLib before 2.20 allow context-dependent attackers to execute arbitrary code via a long string that is converted either (1) from or (2) to a base64 representation.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | glib2.0 | 2.20.0-1 | — |
| Debian 13 | glib2.0 | 2.20.0-1 | — |
| Debian 12 | glib2.0 | 2.20.0-1 | — |
| Debian 5.0 | glib2.0 | 2.16.6-1+lenny1 | DSA-1747-1 |
| Debian 4.0 | glib2.0 | 2.12.4-2+etch1 | DSA-1747-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | glib2 +1 | 2.12.3-4.el5_3.1 | RHSA-2009:0336 |
Advisories 2
- RHSA-2009:0336 Red Hat Security Advisory: glib2 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1747-1 glib2.0 - arbitrary code execution Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://ocert.org/patches/2008-015/glib-CVE-2008-4316.diff
- 20090312 rPSA-2009-0045-1 glib mailing-list
- USN-738-1 vendor-advisory
- 34560 third-party-advisory
- [oss-security] 20090317 Re: [oCERT-2008-015] glib and glib-predecessor heap overflows mailing-list
- 38794 third-party-advisory
- [security-announce] 20100303 VMSA-2010-0004 ESX Service Console and vMA third party updates mailing-list
- MDVSA-2009:080 vendor-advisory
- http://wiki.rpath.com/Advisories:rPSA-2009-0045
- oval:org.mitre.oval:def:11401 vdb-entry signature
- FEDORA-2009-2688 vendor-advisory
- [oss-security] 20090312 [oCERT-2008-015] glib and glib-predecessor heap overflows mailing-list
- 34100 vdb-entry
- 34854 third-party-advisory
- 20090312 [oCERT-2008-015] glib and glib-predecessor heap overflows mailing-list
- 34267 third-party-advisory
- RHSA-2009:0336 vendor-advisory
- 38833 third-party-advisory
- 1021884 vdb-entry
- DSA-1747 vendor-advisory
- 34317 third-party-advisory
- SUSE-SA:2009:026 vendor-advisory
- FEDORA-2009-2657 vendor-advisory
- 34416 third-party-advisory
- http://svn.gnome.org/viewvc/glib?view=revision&revision=7973
- oval:org.mitre.oval:def:8360 vdb-entry signature
- 34404 third-party-advisory
- glib-gbase64-bo(49272) vdb-entry
- 34890 third-party-advisory
- ADV-2010-0528 vdb-entry
- http://www.ocert.org/advisories/ocert-2008-015.html