mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-28 21:11:41 -09:00
1cd4f33690
There have been a number of security fixes of mixed severity in
libglib2 since 2.86.0, sorted by release:
2.87.1
* CVE-2025-13601: Incorrect calculation of buffer size in
g_escape_uri_string()
https://gitlab.gnome.org/GNOME/glib/-/work_items/3827
* CVE-2025-14087: Buffer underflow on Glib through glib/gvariant via
bytestring_parse() or string_parse() leads to OOB Write
https://gitlab.gnome.org/GNOME/glib/-/work_items/3834
* CVE-2025-14512: GIO: Integer overflow in file attribute escaping
https://gitlab.gnome.org/GNOME/glib/-/work_items/3845
2.87.3
* CVE-2026-1484: Integer Overflow -> Buffer Underflow on Glib through
glib/gbase64.c via g_base64_encode_close() leads to OOB Write
https://gitlab.gnome.org/GNOME/glib/-/work_items/3870
* CVE-2026-1485: Buffer underflow on Glib through
gio/gcontenttype-fdo.c via parse_header() lead to OOB Read/Write
https://gitlab.gnome.org/GNOME/glib/-/work_items/3871
* CVE-2026-1489: Integer Overflow on Glib through glib/guniprop.c via
output_marks() lead to OOB Write in glib/gutf8.c:g_unichar_to_utf8()
https://gitlab.gnome.org/GNOME/glib/-/work_items/3872
2.88.1
* CVE-2026-58010: Buffer Over-read on GLib through
glib/gvariant-serialiser.c:1253 via gvs_tuple_is_normal()
https://gitlab.gnome.org/GNOME/glib/-/work_items/3915
* CVE-2026-58011: OOB Read on GLib through
glib/gdatetime.c:g_date_time_get_ymd via invalid `GDateTime`
https://gitlab.gnome.org/GNOME/glib/-/work_items/3917
* CVE-2026-58012: Buffer Over-read on GLib's g_regex_replace() through
glib/gregex.c:string_append() via g_utf8_next_char()
https://gitlab.gnome.org/GNOME/glib/-/work_items/3918
* CVE-2026-58013: Buffer Over-read on GLib through glib/giochannel.c
via "g_io_channel_read_line_backend"
https://gitlab.gnome.org/GNOME/glib/-/work_items/3925
* CVE-2026-58014: Off-by-one Error on GLib through glib/gkeyfile.c via
"g_key_file_get_locale_string_list"
https://gitlab.gnome.org/GNOME/glib/-/work_items/3930
* CVE-2026-58015: Path Traversal on GLib DBus through
glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry,
mechanism_client_data_receive (COOKIE_SHA1 Client Authentication)
leads to Arbitrary File Read (sort of)
https://gitlab.gnome.org/GNOME/glib/-/work_items/3931
2.88.3
* CVE-2026-15588: GDBusServer pre-authentication DoS via unbounded
SASL line buffering
https://gitlab.gnome.org/GNOME/glib/-/work_items/3985
Full upstream changelog:
https://gitlab.gnome.org/GNOME/glib/-/blob/2.88.3/NEWS?ref_type=tags
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e313a2d259)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>