mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-08-09 17:03:35 -09:00
e313a2d259
There have been a number of security fixes of mixed severity in libglib2 since 2.86.0, sorted by release: 2.87.1 * CVE-2025-13601: Incorrect calculation of buffer size in g_escape_uri_string() https://gitlab.gnome.org/GNOME/glib/-/work_items/3827 * CVE-2025-14087: Buffer underflow on Glib through glib/gvariant via bytestring_parse() or string_parse() leads to OOB Write https://gitlab.gnome.org/GNOME/glib/-/work_items/3834 * CVE-2025-14512: GIO: Integer overflow in file attribute escaping https://gitlab.gnome.org/GNOME/glib/-/work_items/3845 2.87.3 * CVE-2026-1484: Integer Overflow -> Buffer Underflow on Glib through glib/gbase64.c via g_base64_encode_close() leads to OOB Write https://gitlab.gnome.org/GNOME/glib/-/work_items/3870 * CVE-2026-1485: Buffer underflow on Glib through gio/gcontenttype-fdo.c via parse_header() lead to OOB Read/Write https://gitlab.gnome.org/GNOME/glib/-/work_items/3871 * CVE-2026-1489: Integer Overflow on Glib through glib/guniprop.c via output_marks() lead to OOB Write in glib/gutf8.c:g_unichar_to_utf8() https://gitlab.gnome.org/GNOME/glib/-/work_items/3872 2.88.1 * CVE-2026-58010: Buffer Over-read on GLib through glib/gvariant-serialiser.c:1253 via gvs_tuple_is_normal() https://gitlab.gnome.org/GNOME/glib/-/work_items/3915 * CVE-2026-58011: OOB Read on GLib through glib/gdatetime.c:g_date_time_get_ymd via invalid `GDateTime` https://gitlab.gnome.org/GNOME/glib/-/work_items/3917 * CVE-2026-58012: Buffer Over-read on GLib's g_regex_replace() through glib/gregex.c:string_append() via g_utf8_next_char() https://gitlab.gnome.org/GNOME/glib/-/work_items/3918 * CVE-2026-58013: Buffer Over-read on GLib through glib/giochannel.c via "g_io_channel_read_line_backend" https://gitlab.gnome.org/GNOME/glib/-/work_items/3925 * CVE-2026-58014: Off-by-one Error on GLib through glib/gkeyfile.c via "g_key_file_get_locale_string_list" https://gitlab.gnome.org/GNOME/glib/-/work_items/3930 * CVE-2026-58015: Path Traversal on GLib DBus through glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry, mechanism_client_data_receive (COOKIE_SHA1 Client Authentication) leads to Arbitrary File Read (sort of) https://gitlab.gnome.org/GNOME/glib/-/work_items/3931 2.88.3 * CVE-2026-15588: GDBusServer pre-authentication DoS via unbounded SASL line buffering https://gitlab.gnome.org/GNOME/glib/-/work_items/3985 Full upstream changelog: https://gitlab.gnome.org/GNOME/glib/-/blob/2.88.3/NEWS?ref_type=tags Signed-off-by: Fiona Klute <fiona.klute@gmx.de> Signed-off-by: Julien Olivain <ju.o@free.fr>