Description
A flaw was found in GLib. The GVariant deserialization code is vulnerable to a heap buffer overflow introduced by the fix for CVE-2023-32665. This bug does not affect any released version of GLib, but does affect GLib distributors who followed the guidance of GLib developers to backport the initial fix for CVE-2023-32665.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| glib | glib | — | 2.75.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | glib2.0 | 2.72.4-0ubuntu2.2 | USN-6165-1 |
| Ubuntu 20.04 LTS | glib2.0 | 2.64.6-1~ubuntu20.04.6 | USN-6165-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | glib2.0 | 2.56.4-0ubuntu0.18.04.9+esm3 | USN-6165-2 |
| Ubuntu Pro 16.04 LTS | glib2.0 | 2.48.2-0ubuntu4.8+esm3 | USN-6165-2 |
| Ubuntu Pro 14.04 LTS | glib2.0 | 2.40.2-0ubuntu1.1+esm6 | USN-6165-2 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | glib2 | 2.54.3-150000.4.29.1 | SUSE-SU-2023:3535-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP1 | glib2 | 2.54.3-150000.4.29.1 | SUSE-SU-2023:3535-1 |
| SLE HPC 15 SP1 | glib2 | 2.54.3-150000.4.29.1 | SUSE-SU-2023:3535-1 |
| SUSE Enterprise Storage 6 | glib2 | 2.54.3-150000.4.29.1 | SUSE-SU-2023:3535-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | glib2 +5 | 2.56.1-9.amzn2.0.9 | ALAS2-2025-2767 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | glib | 2.71.0-4 | — |
Advisories 8
- SSA-398330 SSA-398330: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP >= V3.1.0 and < V3.1.5 Siemens ProductCERT · Oct 13, 2026
- WID-SEC-2023-2917 Xerox FreeFlow Print Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 30, 2026
- USN-6165-2 glib2.0 vulnerabilities Ubuntu Security Notices (USN) · Jun 29, 2026
- USN-6165-1 glib2.0 vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- SUSE-SU-2023:3535-1 Security update for glib2 SUSE / openSUSE Security Updates · Feb 4, 2026
- ICSA-23-348-10 Siemens SIMATIC S7-1500 CISA ICS & IT advisories · Aug 12, 2025
- VDE-2024-073 Phoenix Contact: Multiple Vulnerabilities in PLCnext Firmware CERT@VDE · May 22, 2025
- ALAS2-2025-2767 Important: glib2 security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Feb 25, 2025