GLib vulnerabilities

A flaw was found in Glib's content type parsing logic. This buffer underflow vulnerability occurs because the length of a header line is stored in a signed integer, which can lead to integer wraparound for very large inputs. This results in pointer underflow and out-of-bounds memory access. Exploitation requires a local user to install or process a specially crafted treemagic file, which can lead to local denial of service or application instability.

An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1, where a GDBus-based client subscribing to signals from a trusted system service on a shared computer can receive spoofed D-Bus signals from other users of the same computer.

In GNOME GLib before 2.82.1, the file gio/gsocks4aproxy.c has an off-by-one error leading to a buffer overflow because SOCKS4_CONN_MSG_LEN is insufficient for a trailing null character.

Denial of Service and resource exhaustion vulnerability in the GDBus component of GLib. The gdbusauth authentication mechanism fails to enforce proper length limitations on data lines read from a client. An unauthenticated attacker can send excessively long data streams, causing massive memory and CPU consumption, potentially leading to a crash or system hang.

A flaw in GLib's g_dbus_node_info_new_for_xml() function when processing malformed D-Bus introspection XML can cause an unsigned integer overflow and out-of-bounds read, leading to denial of service.

In GLib, the D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. A malicious D-Bus server can supply a cookie_context containing path traversal sequences, causing the client to read an arbitrary file and exfiltrate sensitive data.

An off-by-one error was found in GLib's g_key_file_get_locale_string_list function in gkeyfile.c when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary.

A flaw was found in GLib where a buffer over-read occurs in g_io_channel_read_line_backend() in giochannel.c when a custom line terminator longer than one byte is set, causing memcmp to read past the GString buffer. This vulnerability can lead to minor information disclosure of 7 bytes or denial of service if the over-read crosses a page boundary.

A flaw was found in GLib where a buffer over-read occurs in the g_regex_replace function when using the G_REGEX_RAW compile flag and case-change replacement escapes. The string_append function processes matched substrings using UTF-8 functions that assume valid UTF-8 input, even when the string is treated as raw bytes. This can lead to minor information disclosure of 1-5 bytes and a denial of service when the buffer over-read crosses a page boundary.

A flaw was found in GLib where an out-of-bounds read of 2 bytes occurs in the g_date_time_get_ymd function in glib/gdatetime.c when processing an invalid GDateTime object created by g_date_time_add_full. This can corrupt date output and cause logic errors.

An off-by-one error was found in GLib in the gvs_tuple_is_normal function within glib/gvariant-serialiser.c. The bounds check uses > instead of >=, causing an out-of-bounds read of one byte during alignment padding checks. This flaw can lead to minor information disclosure of one byte and denial of service if the read crosses a page boundary.

A flaw in glib allows a heap buffer overflow and denial-of-service (DoS) via an integer overflow in the GIO escape_byte_string() function when processing malicious file or remote filesystem attribute values.

A flaw in GLib (Gnome Lib) allows a remote attacker to cause heap corruption via a buffer-underflow in the GVariant parser when processing maliciously crafted input strings, leading to denial of service or potential code execution.

A heap-based buffer overflow was found in glib due to an incorrect buffer size calculation in the g_escape_uri_string() function. If the string contains a very large number of characters that need escaping, the length calculation may overflow, leading to a write beyond the allocated buffer.

A denial of service vulnerability was found in GLib on Windows platforms. It occurs when an application attempts to spawn a program using long command lines.

A flaw was found in GLib, which is vulnerable to an integer overflow in the g_string_insert_unichar() function. When the position at which to insert the character is large, the position will overflow, leading to a buffer underwrite.

A flaw was found in GLib where an integer overflow and buffer under-read occur when parsing a long invalid ISO 8601 timestamp with the g_date_time_new_from_iso8601() function.

In GLib, GVariant deserialization is vulnerable to an exponential blowup issue where a crafted GVariant can cause excessive processing, leading to denial of service.

A flaw was found in GLib's GVariant deserialization code, causing a heap buffer overflow introduced by the fix for CVE-2023-32665. This bug does not affect any released version of GLib but affects distributors who backported the initial fix.

In glib, the gvariant deserialization code is vulnerable to denial of service due to additional input validation introduced to resolve CVE-2023-29499. The offset table validation may be very slow. This bug does not affect any released version of glib but affects distributors who backported the initial fix for CVE-2023-29499.

A flaw was found in GLib related to GVariant deserialization. A crafted GVariant can cause excessive processing, leading to denial of service.

In GLib, GVariant deserialization fails to validate that the input conforms to the expected format, leading to denial of service. The vulnerability affects processing of untrusted GVariant data.

An issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3. The function g_bytes_new has an integer overflow on 64-bit platforms due to an implicit cast from 64 bits to 32 bits. The overflow could potentially lead to memory corruption.