Description
GSocketClient in GNOME GLib through 2.62.4 may occasionally connect directly to a target address instead of connecting via a proxy server when configured to do so, because the proxy_addr field is mishandled. This bug is timing-dependent and may occur only sporadically depending on network delays. The greatest security relevance is in use cases where a proxy is used to help with privacy/anonymity, even though there is no technical barrier to a direct connection. NOTE: versions before 2.60 are unaffected.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | glib2.0 | 2.62.5-1 | — |
| Debian 13 | glib2.0 | 2.62.5-1 | — |
| Debian 12 | glib2.0 | 2.62.5-1 | — |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | glib | 2.62.5-r0 | — |
| Alpine v3.23 | glib | 2.62.5-r0 | — |
| Alpine v3.22 | glib | 2.62.5-r0 | — |
| Alpine v3.21 | glib | 2.62.5-r0 | — |
| Alpine v3.20 | glib | 2.62.5-r0 | — |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | glib | 2.62.5-r0 | — |
| Alpine v3.18 | glib | 2.62.5-r0 | — |
| Alpine v3.17 | glib | 2.62.5-r0 | — |
| Alpine v3.16 | glib | 2.62.5-r0 | — |
| Alpine v3.15 | glib | 2.62.5-r0 | — |
| Alpine v3.14 | glib | 2.62.5-r0 | — |
| Alpine v3.13 | glib | 2.62.5-r0 | — |
| Alpine v3.12 | glib | 2.62.5-r0 | — |
| Alpine v3.11 | glib | 2.62.5-r0 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | glib | 2.71.0-1 | — |