mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-10 00:04:06 -09:00
1cd4f33690
There have been a number of security fixes of mixed severity in
libglib2 since 2.86.0, sorted by release:
2.87.1
* CVE-2025-13601: Incorrect calculation of buffer size in
g_escape_uri_string()
https://gitlab.gnome.org/GNOME/glib/-/work_items/3827
* CVE-2025-14087: Buffer underflow on Glib through glib/gvariant via
bytestring_parse() or string_parse() leads to OOB Write
https://gitlab.gnome.org/GNOME/glib/-/work_items/3834
* CVE-2025-14512: GIO: Integer overflow in file attribute escaping
https://gitlab.gnome.org/GNOME/glib/-/work_items/3845
2.87.3
* CVE-2026-1484: Integer Overflow -> Buffer Underflow on Glib through
glib/gbase64.c via g_base64_encode_close() leads to OOB Write
https://gitlab.gnome.org/GNOME/glib/-/work_items/3870
* CVE-2026-1485: Buffer underflow on Glib through
gio/gcontenttype-fdo.c via parse_header() lead to OOB Read/Write
https://gitlab.gnome.org/GNOME/glib/-/work_items/3871
* CVE-2026-1489: Integer Overflow on Glib through glib/guniprop.c via
output_marks() lead to OOB Write in glib/gutf8.c:g_unichar_to_utf8()
https://gitlab.gnome.org/GNOME/glib/-/work_items/3872
2.88.1
* CVE-2026-58010: Buffer Over-read on GLib through
glib/gvariant-serialiser.c:1253 via gvs_tuple_is_normal()
https://gitlab.gnome.org/GNOME/glib/-/work_items/3915
* CVE-2026-58011: OOB Read on GLib through
glib/gdatetime.c:g_date_time_get_ymd via invalid `GDateTime`
https://gitlab.gnome.org/GNOME/glib/-/work_items/3917
* CVE-2026-58012: Buffer Over-read on GLib's g_regex_replace() through
glib/gregex.c:string_append() via g_utf8_next_char()
https://gitlab.gnome.org/GNOME/glib/-/work_items/3918
* CVE-2026-58013: Buffer Over-read on GLib through glib/giochannel.c
via "g_io_channel_read_line_backend"
https://gitlab.gnome.org/GNOME/glib/-/work_items/3925
* CVE-2026-58014: Off-by-one Error on GLib through glib/gkeyfile.c via
"g_key_file_get_locale_string_list"
https://gitlab.gnome.org/GNOME/glib/-/work_items/3930
* CVE-2026-58015: Path Traversal on GLib DBus through
glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry,
mechanism_client_data_receive (COOKIE_SHA1 Client Authentication)
leads to Arbitrary File Read (sort of)
https://gitlab.gnome.org/GNOME/glib/-/work_items/3931
2.88.3
* CVE-2026-15588: GDBusServer pre-authentication DoS via unbounded
SASL line buffering
https://gitlab.gnome.org/GNOME/glib/-/work_items/3985
Full upstream changelog:
https://gitlab.gnome.org/GNOME/glib/-/blob/2.88.3/NEWS?ref_type=tags
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e313a2d259)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Buildroot is a simple, efficient and easy-to-use tool to generate embedded Linux systems through cross-compilation. The documentation can be found in docs/manual. You can generate a text document with 'make manual-text' and read output/docs/manual/manual.text. Online documentation can be found at https://buildroot.org/docs.html To build and use the buildroot stuff, do the following: 1) run 'make menuconfig' 2) select the target architecture and the packages you wish to compile 3) run 'make' 4) wait while it compiles 5) find the kernel, bootloader, root filesystem, etc. in output/images You do not need to be root to build or run buildroot. Have fun! Buildroot comes with a basic configuration for a number of boards. Run 'make list-defconfigs' to view the list of provided configurations. Please feed suggestions, bug reports, insults, and bribes back to the buildroot mailing list: buildroot@buildroot.org You can also find us on #buildroot on OFTC IRC. If you would like to contribute patches, please read https://buildroot.org/manual.html#submitting-patches