Vulnerability-Lookup

RHSA-2025:14991

Vulnerability from csaf_redhat - Published: 2025-09-02 02:10 - Updated: 2026-10-16 10:56

Summary

Red Hat Security Advisory: glib2 security update

Severity

Moderate

Notes

Topic: An update for glib2 is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * glib2: Signal subscription vulnerabilities (CVE-2024-34397) * glib: buffer overflow in set_connect_msg() (CVE-2024-52533) * glib: Buffer Underflow on GLib through glib/gstring.c via function g_string_insert_unichar (CVE-2025-4373) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2024-34397

A flaw was found in GNOME GLib. When a GDBus-based client subscribes to signals from a trusted system service such as NetworkManager on a shared computer, other users of the same computer can send spoofed D-Bus signals that the GDBus-based client will wrongly interpret as having been sent by the trusted system service. This issue could lead to the GDBus-based client behaving incorrectly with an application-dependent impact.

3.8 (Low)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

CWE-940 - Improper Verification of Source of a Communication Channel

Affected products

Fixed 17 products

Product	Version	Remediation
Unresolved product id: BaseOS-8.2.0.Z.AUS:glib2-0:2.56.4-8.el8_2.2.i686	—	Vendor Fix fix
Unresolved product id: BaseOS-8.2.0.Z.AUS:glib2-0:2.56.4-8.el8_2.2.src	—	Vendor Fix fix
Unresolved product id: BaseOS-8.2.0.Z.AUS:glib2-0:2.56.4-8.el8_2.2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-8.2.0.Z.AUS:glib2-debuginfo-0:2.56.4-8.el8_2.2.i686	—	Vendor Fix fix
Unresolved product id: BaseOS-8.2.0.Z.AUS:glib2-debuginfo-0:2.56.4-8.el8_2.2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-8.2.0.Z.AUS:glib2-debugsource-0:2.56.4-8.el8_2.2.i686	—	Vendor Fix fix
Unresolved product id: BaseOS-8.2.0.Z.AUS:glib2-debugsource-0:2.56.4-8.el8_2.2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-8.2.0.Z.AUS:glib2-devel-0:2.56.4-8.el8_2.2.i686	—	Vendor Fix fix
Unresolved product id: BaseOS-8.2.0.Z.AUS:glib2-devel-0:2.56.4-8.el8_2.2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-8.2.0.Z.AUS:glib2-devel-debuginfo-0:2.56.4-8.el8_2.2.i686	—	Vendor Fix fix
Unresolved product id: BaseOS-8.2.0.Z.AUS:glib2-devel-debuginfo-0:2.56.4-8.el8_2.2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-8.2.0.Z.AUS:glib2-fam-0:2.56.4-8.el8_2.2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-8.2.0.Z.AUS:glib2-fam-debuginfo-0:2.56.4-8.el8_2.2.i686	—	Vendor Fix fix
Unresolved product id: BaseOS-8.2.0.Z.AUS:glib2-fam-debuginfo-0:2.56.4-8.el8_2.2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-8.2.0.Z.AUS:glib2-tests-0:2.56.4-8.el8_2.2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-8.2.0.Z.AUS:glib2-tests-debuginfo-0:2.56.4-8.el8_2.2.i686	—	Vendor Fix fix
Unresolved product id: BaseOS-8.2.0.Z.AUS:glib2-tests-debuginfo-0:2.56.4-8.el8_2.2.x86_64	—	Vendor Fix fix

Threats

Impact Moderate

CVE-2024-52533

A flaw was found in the Glib library. A buffer overflow condition can be triggered in certain conditions due to an off-by-one error in SOCKS4_CONN_MSG_LEN. This issue may lead to an application crash or other undefined behavior.

7.0 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

CWE-193 - Off-by-one Error

Affected products

Fixed 17 products, the same list as for CVE-2024-34397

Threats

Impact Moderate

CVE-2025-4373

A flaw was found in GLib, which is vulnerable to an integer overflow in the g_string_insert_unichar() function. When the position at which to insert the character is large, the position will overflow, leading to a buffer underwrite.

4.8 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

CWE-124 - Buffer Underwrite ('Buffer Underflow')

Affected products

Fixed 17 products, the same list as for CVE-2024-34397

Threats

Impact Moderate

References

24 references

URL	Category
https://access.redhat.com/errata/RHSA-2025:14991	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2279632	external
https://bugzilla.redhat.com/show_bug.cgi?id=2325340	external
https://bugzilla.redhat.com/show_bug.cgi?id=2364265	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2024-34397	self
https://bugzilla.redhat.com/show_bug.cgi?id=2279632	external
https://www.cve.org/CVERecord?id=CVE-2024-34397	external
https://nvd.nist.gov/vuln/detail/CVE-2024-34397	external
https://gitlab.gnome.org/GNOME/glib/-/issues/3268	external
https://www.openwall.com/lists/oss-security/2024/…	external
https://access.redhat.com/security/cve/CVE-2024-52533	self
https://bugzilla.redhat.com/show_bug.cgi?id=2325340	external
https://www.cve.org/CVERecord?id=CVE-2024-52533	external
https://nvd.nist.gov/vuln/detail/CVE-2024-52533	external
https://gitlab.gnome.org/GNOME/glib/-/issues/3461	external
https://gitlab.gnome.org/GNOME/glib/-/releases/2.82.1	external
https://gitlab.gnome.org/Teams/Releng/security/-/…	external
https://access.redhat.com/security/cve/CVE-2025-4373	self
https://bugzilla.redhat.com/show_bug.cgi?id=2364265	external
https://www.cve.org/CVERecord?id=CVE-2025-4373	external
https://nvd.nist.gov/vuln/detail/CVE-2025-4373	external
https://gitlab.gnome.org/GNOME/glib/-/issues/3677	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for glib2 is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures.\n\nSecurity Fix(es):\n\n* glib2: Signal subscription vulnerabilities (CVE-2024-34397)\n\n* glib: buffer overflow in set_connect_msg() (CVE-2024-52533)\n\n* glib: Buffer Underflow on GLib through glib/gstring.c via function g_string_insert_unichar (CVE-2025-4373)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2025:14991",
        "url": "https://access.redhat.com/errata/RHSA-2025:14991"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "2279632",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2279632"
      },
      {
        "category": "external",
        "summary": "2325340",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2325340"
      },
      {
        "category": "external",
        "summary": "2364265",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2364265"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_14991.json"
      }
    ],
    "title": "Red Hat Security Advisory: glib2 security update",
    "tracking": {
      "current_release_date": "2026-10-16T10:56:49+00:00",
      "generator": {
        "date": "2026-10-16T10:56:49+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.2"
        }
      },
      "id": "RHSA-2025:14991",
      "initial_release_date": "2025-09-02T02:10:04+00:00",
      "revision_history": [
        {
          "date": "2025-09-02T02:10:04+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2025-09-02T02:10:04+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-16T10:56:49+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux BaseOS AUS (v. 8.2)",
                "product": {
                  "name": "Red Hat Enterprise Linux BaseOS AUS (v. 8.2)",
                  "product_id": "BaseOS-8.2.0.Z.AUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:rhel_aus:8.2::baseos"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "glib2-0:2.56.4-8.el8_2.2.src",
                "product": {
                  "name": "glib2-0:2.56.4-8.el8_2.2.src",
                  "product_id": "glib2-0:2.56.4-8.el8_2.2.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/glib2@2.56.4-8.el8_2.2?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "glib2-0:2.56.4-8.el8_2.2.i686",
                "product": {
                  "name": "glib2-0:2.56.4-8.el8_2.2.i686",
                  "product_id": "glib2-0:2.56.4-8.el8_2.2.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/glib2@2.56.4-8.el8_2.2?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "glib2-devel-0:2.56.4-8.el8_2.2.i686",
                "product": {
                  "name": "glib2-devel-0:2.56.4-8.el8_2.2.i686",
                  "product_id": "glib2-devel-0:2.56.4-8.el8_2.2.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/glib2-devel@2.56.4-8.el8_2.2?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "glib2-debugsource-0:2.56.4-8.el8_2.2.i686",
                "product": {
                  "name": "glib2-debugsource-0:2.56.4-8.el8_2.2.i686",
                  "product_id": "glib2-debugsource-0:2.56.4-8.el8_2.2.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/glib2-debugsource@2.56.4-8.el8_2.2?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "glib2-debuginfo-0:2.56.4-8.el8_2.2.i686",
                "product": {
                  "name": "glib2-debuginfo-0:2.56.4-8.el8_2.2.i686",
                  "product_id": "glib2-debuginfo-0:2.56.4-8.el8_2.2.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/glib2-debuginfo@2.56.4-8.el8_2.2?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "glib2-devel-debuginfo-0:2.56.4-8.el8_2.2.i686",
                "product": {
                  "name": "glib2-devel-debuginfo-0:2.56.4-8.el8_2.2.i686",
                  "product_id": "glib2-devel-debuginfo-0:2.56.4-8.el8_2.2.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/glib2-devel-debuginfo@2.56.4-8.el8_2.2?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "glib2-fam-debuginfo-0:2.56.4-8.el8_2.2.i686",
                "product": {
                  "name": "glib2-fam-debuginfo-0:2.56.4-8.el8_2.2.i686",
                  "product_id": "glib2-fam-debuginfo-0:2.56.4-8.el8_2.2.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/glib2-fam-debuginfo@2.56.4-8.el8_2.2?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "glib2-tests-debuginfo-0:2.56.4-8.el8_2.2.i686",
                "product": {
                  "name": "glib2-tests-debuginfo-0:2.56.4-8.el8_2.2.i686",
                  "product_id": "glib2-tests-debuginfo-0:2.56.4-8.el8_2.2.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/glib2-tests-debuginfo@2.56.4-8.el8_2.2?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "glib2-0:2.56.4-8.el8_2.2.x86_64",
                "product": {
                  "name": "glib2-0:2.56.4-8.el8_2.2.x86_64",
                  "product_id": "glib2-0:2.56.4-8.el8_2.2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/glib2@2.56.4-8.el8_2.2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "glib2-devel-0:2.56.4-8.el8_2.2.x86_64",
                "product": {
                  "name": "glib2-devel-0:2.56.4-8.el8_2.2.x86_64",
                  "product_id": "glib2-devel-0:2.56.4-8.el8_2.2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/glib2-devel@2.56.4-8.el8_2.2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "glib2-fam-0:2.56.4-8.el8_2.2.x86_64",
                "product": {
                  "name": "glib2-fam-0:2.56.4-8.el8_2.2.x86_64",
                  "product_id": "glib2-fam-0:2.56.4-8.el8_2.2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/glib2-fam@2.56.4-8.el8_2.2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "glib2-tests-0:2.56.4-8.el8_2.2.x86_64",
                "product": {
                  "name": "glib2-tests-0:2.56.4-8.el8_2.2.x86_64",
                  "product_id": "glib2-tests-0:2.56.4-8.el8_2.2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/glib2-tests@2.56.4-8.el8_2.2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "glib2-debugsource-0:2.56.4-8.el8_2.2.x86_64",
                "product": {
                  "name": "glib2-debugsource-0:2.56.4-8.el8_2.2.x86_64",
                  "product_id": "glib2-debugsource-0:2.56.4-8.el8_2.2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/glib2-debugsource@2.56.4-8.el8_2.2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "glib2-debuginfo-0:2.56.4-8.el8_2.2.x86_64",
                "product": {
                  "name": "glib2-debuginfo-0:2.56.4-8.el8_2.2.x86_64",
                  "product_id": "glib2-debuginfo-0:2.56.4-8.el8_2.2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/glib2-debuginfo@2.56.4-8.el8_2.2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "glib2-devel-debuginfo-0:2.56.4-8.el8_2.2.x86_64",
                "product": {
                  "name": "glib2-devel-debuginfo-0:2.56.4-8.el8_2.2.x86_64",
                  "product_id": "glib2-devel-debuginfo-0:2.56.4-8.el8_2.2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/glib2-devel-debuginfo@2.56.4-8.el8_2.2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "glib2-fam-debuginfo-0:2.56.4-8.el8_2.2.x86_64",
                "product": {
                  "name": "glib2-fam-debuginfo-0:2.56.4-8.el8_2.2.x86_64",
                  "product_id": "glib2-fam-debuginfo-0:2.56.4-8.el8_2.2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/glib2-fam-debuginfo@2.56.4-8.el8_2.2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "glib2-tests-debuginfo-0:2.56.4-8.el8_2.2.x86_64",
                "product": {
                  "name": "glib2-tests-debuginfo-0:2.56.4-8.el8_2.2.x86_64",
                  "product_id": "glib2-tests-debuginfo-0:2.56.4-8.el8_2.2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/glib2-tests-debuginfo@2.56.4-8.el8_2.2?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "glib2-0:2.56.4-8.el8_2.2.i686 as a component of Red Hat Enterprise Linux BaseOS AUS (v. 8.2)",
          "product_id": "BaseOS-8.2.0.Z.AUS:glib2-0:2.56.4-8.el8_2.2.i686"
        },
        "product_reference": "glib2-0:2.56.4-8.el8_2.2.i686",
        "relates_to_product_reference": "BaseOS-8.2.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "glib2-0:2.56.4-8.el8_2.2.src as a component of Red Hat Enterprise Linux BaseOS AUS (v. 8.2)",
          "product_id": "BaseOS-8.2.0.Z.AUS:glib2-0:2.56.4-8.el8_2.2.src"
        },
        "product_reference": "glib2-0:2.56.4-8.el8_2.2.src",
        "relates_to_product_reference": "BaseOS-8.2.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "glib2-0:2.56.4-8.el8_2.2.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v. 8.2)",
          "product_id": "BaseOS-8.2.0.Z.AUS:glib2-0:2.56.4-8.el8_2.2.x86_64"
        },
        "product_reference": "glib2-0:2.56.4-8.el8_2.2.x86_64",
        "relates_to_product_reference": "BaseOS-8.2.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "glib2-debuginfo-0:2.56.4-8.el8_2.2.i686 as a component of Red Hat Enterprise Linux BaseOS AUS (v. 8.2)",
          "product_id": "BaseOS-8.2.0.Z.AUS:glib2-debuginfo-0:2.56.4-8.el8_2.2.i686"
        },
        "product_reference": "glib2-debuginfo-0:2.56.4-8.el8_2.2.i686",
        "relates_to_product_reference": "BaseOS-8.2.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "glib2-debuginfo-0:2.56.4-8.el8_2.2.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v. 8.2)",
          "product_id": "BaseOS-8.2.0.Z.AUS:glib2-debuginfo-0:2.56.4-8.el8_2.2.x86_64"
        },
        "product_reference": "glib2-debuginfo-0:2.56.4-8.el8_2.2.x86_64",
        "relates_to_product_reference": "BaseOS-8.2.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "glib2-debugsource-0:2.56.4-8.el8_2.2.i686 as a component of Red Hat Enterprise Linux BaseOS AUS (v. 8.2)",
          "product_id": "BaseOS-8.2.0.Z.AUS:glib2-debugsource-0:2.56.4-8.el8_2.2.i686"
        },
        "product_reference": "glib2-debugsource-0:2.56.4-8.el8_2.2.i686",
        "relates_to_product_reference": "BaseOS-8.2.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "glib2-debugsource-0:2.56.4-8.el8_2.2.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v. 8.2)",
          "product_id": "BaseOS-8.2.0.Z.AUS:glib2-debugsource-0:2.56.4-8.el8_2.2.x86_64"
        },
        "product_reference": "glib2-debugsource-0:2.56.4-8.el8_2.2.x86_64",
        "relates_to_product_reference": "BaseOS-8.2.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "glib2-devel-0:2.56.4-8.el8_2.2.i686 as a component of Red Hat Enterprise Linux BaseOS AUS (v. 8.2)",
          "product_id": "BaseOS-8.2.0.Z.AUS:glib2-devel-0:2.56.4-8.el8_2.2.i686"
        },
        "product_reference": "glib2-devel-0:2.56.4-8.el8_2.2.i686",
        "relates_to_product_reference": "BaseOS-8.2.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "glib2-devel-0:2.56.4-8.el8_2.2.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v. 8.2)",
          "product_id": "BaseOS-8.2.0.Z.AUS:glib2-devel-0:2.56.4-8.el8_2.2.x86_64"
        },
        "product_reference": "glib2-devel-0:2.56.4-8.el8_2.2.x86_64",
        "relates_to_product_reference": "BaseOS-8.2.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "glib2-devel-debuginfo-0:2.56.4-8.el8_2.2.i686 as a component of Red Hat Enterprise Linux BaseOS AUS (v. 8.2)",
          "product_id": "BaseOS-8.2.0.Z.AUS:glib2-devel-debuginfo-0:2.56.4-8.el8_2.2.i686"
        },
        "product_reference": "glib2-devel-debuginfo-0:2.56.4-8.el8_2.2.i686",
        "relates_to_product_reference": "BaseOS-8.2.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "glib2-devel-debuginfo-0:2.56.4-8.el8_2.2.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v. 8.2)",
          "product_id": "BaseOS-8.2.0.Z.AUS:glib2-devel-debuginfo-0:2.56.4-8.el8_2.2.x86_64"
        },
        "product_reference": "glib2-devel-debuginfo-0:2.56.4-8.el8_2.2.x86_64",
        "relates_to_product_reference": "BaseOS-8.2.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "glib2-fam-0:2.56.4-8.el8_2.2.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v. 8.2)",
          "product_id": "BaseOS-8.2.0.Z.AUS:glib2-fam-0:2.56.4-8.el8_2.2.x86_64"
        },
        "product_reference": "glib2-fam-0:2.56.4-8.el8_2.2.x86_64",
        "relates_to_product_reference": "BaseOS-8.2.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "glib2-fam-debuginfo-0:2.56.4-8.el8_2.2.i686 as a component of Red Hat Enterprise Linux BaseOS AUS (v. 8.2)",
          "product_id": "BaseOS-8.2.0.Z.AUS:glib2-fam-debuginfo-0:2.56.4-8.el8_2.2.i686"
        },
        "product_reference": "glib2-fam-debuginfo-0:2.56.4-8.el8_2.2.i686",
        "relates_to_product_reference": "BaseOS-8.2.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "glib2-fam-debuginfo-0:2.56.4-8.el8_2.2.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v. 8.2)",
          "product_id": "BaseOS-8.2.0.Z.AUS:glib2-fam-debuginfo-0:2.56.4-8.el8_2.2.x86_64"
        },
        "product_reference": "glib2-fam-debuginfo-0:2.56.4-8.el8_2.2.x86_64",
        "relates_to_product_reference": "BaseOS-8.2.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "glib2-tests-0:2.56.4-8.el8_2.2.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v. 8.2)",
          "product_id": "BaseOS-8.2.0.Z.AUS:glib2-tests-0:2.56.4-8.el8_2.2.x86_64"
        },
        "product_reference": "glib2-tests-0:2.56.4-8.el8_2.2.x86_64",
        "relates_to_product_reference": "BaseOS-8.2.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "glib2-tests-debuginfo-0:2.56.4-8.el8_2.2.i686 as a component of Red Hat Enterprise Linux BaseOS AUS (v. 8.2)",
          "product_id": "BaseOS-8.2.0.Z.AUS:glib2-tests-debuginfo-0:2.56.4-8.el8_2.2.i686"
        },
        "product_reference": "glib2-tests-debuginfo-0:2.56.4-8.el8_2.2.i686",
        "relates_to_product_reference": "BaseOS-8.2.0.Z.AUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "glib2-tests-debuginfo-0:2.56.4-8.el8_2.2.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v. 8.2)",
          "product_id": "BaseOS-8.2.0.Z.AUS:glib2-tests-debuginfo-0:2.56.4-8.el8_2.2.x86_64"
        },
        "product_reference": "glib2-tests-debuginfo-0:2.56.4-8.el8_2.2.x86_64",
        "relates_to_product_reference": "BaseOS-8.2.0.Z.AUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-34397",
      "cwe": {
        "id": "CWE-940",
        "name": "Improper Verification of Source of a Communication Channel"
      },
      "discovery_date": "2024-05-07T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2279632"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in GNOME GLib. When a GDBus-based client subscribes to signals from a trusted system service such as NetworkManager on a shared computer, other users of the same computer can send spoofed D-Bus signals that the GDBus-based client will wrongly interpret as having been sent by the trusted system service. This issue could lead to the GDBus-based client behaving incorrectly with an application-dependent impact.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "glib2: Signal subscription vulnerabilities",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-8.2.0.Z.AUS:glib2-0:2.56.4-8.el8_2.2.i686",
          "BaseOS-8.2.0.Z.AUS:glib2-0:2.56.4-8.el8_2.2.src",
          "BaseOS-8.2.0.Z.AUS:glib2-0:2.56.4-8.el8_2.2.x86_64",
          "BaseOS-8.2.0.Z.AUS:glib2-debuginfo-0:2.56.4-8.el8_2.2.i686",
          "BaseOS-8.2.0.Z.AUS:glib2-debuginfo-0:2.56.4-8.el8_2.2.x86_64",
          "BaseOS-8.2.0.Z.AUS:glib2-debugsource-0:2.56.4-8.el8_2.2.i686",
          "BaseOS-8.2.0.Z.AUS:glib2-debugsource-0:2.56.4-8.el8_2.2.x86_64",
          "BaseOS-8.2.0.Z.AUS:glib2-devel-0:2.56.4-8.el8_2.2.i686",
          "BaseOS-8.2.0.Z.AUS:glib2-devel-0:2.56.4-8.el8_2.2.x86_64",
          "BaseOS-8.2.0.Z.AUS:glib2-devel-debuginfo-0:2.56.4-8.el8_2.2.i686",
          "BaseOS-8.2.0.Z.AUS:glib2-devel-debuginfo-0:2.56.4-8.el8_2.2.x86_64",
          "BaseOS-8.2.0.Z.AUS:glib2-fam-0:2.56.4-8.el8_2.2.x86_64",
          "BaseOS-8.2.0.Z.AUS:glib2-fam-debuginfo-0:2.56.4-8.el8_2.2.i686",
          "BaseOS-8.2.0.Z.AUS:glib2-fam-debuginfo-0:2.56.4-8.el8_2.2.x86_64",
          "BaseOS-8.2.0.Z.AUS:glib2-tests-0:2.56.4-8.el8_2.2.x86_64",
          "BaseOS-8.2.0.Z.AUS:glib2-tests-debuginfo-0:2.56.4-8.el8_2.2.i686",
          "BaseOS-8.2.0.Z.AUS:glib2-tests-debuginfo-0:2.56.4-8.el8_2.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-34397"
        },
        {
          "category": "external",
          "summary": "RHBZ#2279632",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2279632"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-34397",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-34397"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-34397",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34397"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/glib/-/issues/3268",
          "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3268"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2024/05/07/5",
          "url": "https://www.openwall.com/lists/oss-security/2024/05/07/5"
        }
      ],
      "release_date": "2024-05-07T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-09-02T02:10:04+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-8.2.0.Z.AUS:glib2-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-0:2.56.4-8.el8_2.2.src",
            "BaseOS-8.2.0.Z.AUS:glib2-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-debuginfo-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-debuginfo-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-debugsource-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-debugsource-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-devel-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-devel-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-devel-debuginfo-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-devel-debuginfo-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-fam-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-fam-debuginfo-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-fam-debuginfo-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-tests-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-tests-debuginfo-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-tests-debuginfo-0:2.56.4-8.el8_2.2.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:14991"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 3.8,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "BaseOS-8.2.0.Z.AUS:glib2-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-0:2.56.4-8.el8_2.2.src",
            "BaseOS-8.2.0.Z.AUS:glib2-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-debuginfo-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-debuginfo-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-debugsource-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-debugsource-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-devel-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-devel-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-devel-debuginfo-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-devel-debuginfo-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-fam-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-fam-debuginfo-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-fam-debuginfo-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-tests-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-tests-debuginfo-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-tests-debuginfo-0:2.56.4-8.el8_2.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "glib2: Signal subscription vulnerabilities"
    },
    {
      "cve": "CVE-2024-52533",
      "cwe": {
        "id": "CWE-193",
        "name": "Off-by-one Error"
      },
      "discovery_date": "2024-11-11T23:00:48.125765+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2325340"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Glib library. A buffer overflow condition can be triggered in certain conditions due to an off-by-one error in SOCKS4_CONN_MSG_LEN. This issue may lead to an application crash or other undefined behavior.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "glib: buffer overflow in set_connect_msg()",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-8.2.0.Z.AUS:glib2-0:2.56.4-8.el8_2.2.i686",
          "BaseOS-8.2.0.Z.AUS:glib2-0:2.56.4-8.el8_2.2.src",
          "BaseOS-8.2.0.Z.AUS:glib2-0:2.56.4-8.el8_2.2.x86_64",
          "BaseOS-8.2.0.Z.AUS:glib2-debuginfo-0:2.56.4-8.el8_2.2.i686",
          "BaseOS-8.2.0.Z.AUS:glib2-debuginfo-0:2.56.4-8.el8_2.2.x86_64",
          "BaseOS-8.2.0.Z.AUS:glib2-debugsource-0:2.56.4-8.el8_2.2.i686",
          "BaseOS-8.2.0.Z.AUS:glib2-debugsource-0:2.56.4-8.el8_2.2.x86_64",
          "BaseOS-8.2.0.Z.AUS:glib2-devel-0:2.56.4-8.el8_2.2.i686",
          "BaseOS-8.2.0.Z.AUS:glib2-devel-0:2.56.4-8.el8_2.2.x86_64",
          "BaseOS-8.2.0.Z.AUS:glib2-devel-debuginfo-0:2.56.4-8.el8_2.2.i686",
          "BaseOS-8.2.0.Z.AUS:glib2-devel-debuginfo-0:2.56.4-8.el8_2.2.x86_64",
          "BaseOS-8.2.0.Z.AUS:glib2-fam-0:2.56.4-8.el8_2.2.x86_64",
          "BaseOS-8.2.0.Z.AUS:glib2-fam-debuginfo-0:2.56.4-8.el8_2.2.i686",
          "BaseOS-8.2.0.Z.AUS:glib2-fam-debuginfo-0:2.56.4-8.el8_2.2.x86_64",
          "BaseOS-8.2.0.Z.AUS:glib2-tests-0:2.56.4-8.el8_2.2.x86_64",
          "BaseOS-8.2.0.Z.AUS:glib2-tests-debuginfo-0:2.56.4-8.el8_2.2.i686",
          "BaseOS-8.2.0.Z.AUS:glib2-tests-debuginfo-0:2.56.4-8.el8_2.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-52533"
        },
        {
          "category": "external",
          "summary": "RHBZ#2325340",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2325340"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-52533",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-52533"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-52533",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52533"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/glib/-/issues/3461",
          "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3461"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/glib/-/releases/2.82.1",
          "url": "https://gitlab.gnome.org/GNOME/glib/-/releases/2.82.1"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/Teams/Releng/security/-/wikis/home",
          "url": "https://gitlab.gnome.org/Teams/Releng/security/-/wikis/home"
        }
      ],
      "release_date": "2024-11-11T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-09-02T02:10:04+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-8.2.0.Z.AUS:glib2-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-0:2.56.4-8.el8_2.2.src",
            "BaseOS-8.2.0.Z.AUS:glib2-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-debuginfo-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-debuginfo-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-debugsource-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-debugsource-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-devel-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-devel-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-devel-debuginfo-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-devel-debuginfo-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-fam-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-fam-debuginfo-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-fam-debuginfo-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-tests-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-tests-debuginfo-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-tests-debuginfo-0:2.56.4-8.el8_2.2.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:14991"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "BaseOS-8.2.0.Z.AUS:glib2-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-0:2.56.4-8.el8_2.2.src",
            "BaseOS-8.2.0.Z.AUS:glib2-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-debuginfo-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-debuginfo-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-debugsource-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-debugsource-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-devel-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-devel-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-devel-debuginfo-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-devel-debuginfo-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-fam-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-fam-debuginfo-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-fam-debuginfo-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-tests-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-tests-debuginfo-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-tests-debuginfo-0:2.56.4-8.el8_2.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "BaseOS-8.2.0.Z.AUS:glib2-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-0:2.56.4-8.el8_2.2.src",
            "BaseOS-8.2.0.Z.AUS:glib2-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-debuginfo-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-debuginfo-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-debugsource-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-debugsource-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-devel-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-devel-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-devel-debuginfo-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-devel-debuginfo-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-fam-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-fam-debuginfo-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-fam-debuginfo-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-tests-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-tests-debuginfo-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-tests-debuginfo-0:2.56.4-8.el8_2.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "glib: buffer overflow in set_connect_msg()"
    },
    {
      "cve": "CVE-2025-4373",
      "cwe": {
        "id": "CWE-124",
        "name": "Buffer Underwrite (\u0027Buffer Underflow\u0027)"
      },
      "discovery_date": "2025-05-06T00:33:30.003000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2364265"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in GLib, which is vulnerable to an integer overflow in the g_string_insert_unichar() function. When the position at which to insert the character is large, the position will overflow, leading to a buffer underwrite.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "glib: Buffer Underflow on GLib through glib/gstring.c via function g_string_insert_unichar",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "An integer overflow leading to a buffer underwrite was found in GLib, affecting the glib2 package and other components in Red Hat Enterprise Linux and Fedora; Red Hat rates this flaw Moderate severity. The flaw is in the g_string_insert_unichar() function: when a GLib-based application inserts a character at a very large position within a GString, the position value overflows and the character is written before the start of the string\u0027s buffer, corrupting memory outside the intended buffer. Exploitation requires an attacker to influence the insertion position passed by a vulnerable application; successful exploitation could result in limited data corruption or an application crash. The Red Hat severity assessment (Moderate, CVSS 3.1 score 4.8) is consistent with the CVE.org rating. In Red Hat Enterprise Linux, the glib2 package is affected and a fix is being pursued through the standard update process for the affected streams. Additional Red Hat Enterprise Linux components affected by the same flaw, along with the glib2 package in the RHEL 6 and RHEL 7 extended lifecycle support streams, currently have their fixes deferred to a future update; those products remain affected in the meantime, leaving the residual risk that an application passes an attacker-influenced insertion position to g_string_insert_unichar(). Fedora is also affected, with remediation delegated to the Fedora community maintainers.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-8.2.0.Z.AUS:glib2-0:2.56.4-8.el8_2.2.i686",
          "BaseOS-8.2.0.Z.AUS:glib2-0:2.56.4-8.el8_2.2.src",
          "BaseOS-8.2.0.Z.AUS:glib2-0:2.56.4-8.el8_2.2.x86_64",
          "BaseOS-8.2.0.Z.AUS:glib2-debuginfo-0:2.56.4-8.el8_2.2.i686",
          "BaseOS-8.2.0.Z.AUS:glib2-debuginfo-0:2.56.4-8.el8_2.2.x86_64",
          "BaseOS-8.2.0.Z.AUS:glib2-debugsource-0:2.56.4-8.el8_2.2.i686",
          "BaseOS-8.2.0.Z.AUS:glib2-debugsource-0:2.56.4-8.el8_2.2.x86_64",
          "BaseOS-8.2.0.Z.AUS:glib2-devel-0:2.56.4-8.el8_2.2.i686",
          "BaseOS-8.2.0.Z.AUS:glib2-devel-0:2.56.4-8.el8_2.2.x86_64",
          "BaseOS-8.2.0.Z.AUS:glib2-devel-debuginfo-0:2.56.4-8.el8_2.2.i686",
          "BaseOS-8.2.0.Z.AUS:glib2-devel-debuginfo-0:2.56.4-8.el8_2.2.x86_64",
          "BaseOS-8.2.0.Z.AUS:glib2-fam-0:2.56.4-8.el8_2.2.x86_64",
          "BaseOS-8.2.0.Z.AUS:glib2-fam-debuginfo-0:2.56.4-8.el8_2.2.i686",
          "BaseOS-8.2.0.Z.AUS:glib2-fam-debuginfo-0:2.56.4-8.el8_2.2.x86_64",
          "BaseOS-8.2.0.Z.AUS:glib2-tests-0:2.56.4-8.el8_2.2.x86_64",
          "BaseOS-8.2.0.Z.AUS:glib2-tests-debuginfo-0:2.56.4-8.el8_2.2.i686",
          "BaseOS-8.2.0.Z.AUS:glib2-tests-debuginfo-0:2.56.4-8.el8_2.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-4373"
        },
        {
          "category": "external",
          "summary": "RHBZ#2364265",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2364265"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-4373",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-4373"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-4373",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4373"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/glib/-/issues/3677",
          "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3677"
        }
      ],
      "release_date": "2025-05-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-09-02T02:10:04+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-8.2.0.Z.AUS:glib2-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-0:2.56.4-8.el8_2.2.src",
            "BaseOS-8.2.0.Z.AUS:glib2-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-debuginfo-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-debuginfo-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-debugsource-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-debugsource-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-devel-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-devel-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-devel-debuginfo-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-devel-debuginfo-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-fam-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-fam-debuginfo-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-fam-debuginfo-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-tests-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-tests-debuginfo-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-tests-debuginfo-0:2.56.4-8.el8_2.2.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:14991"
        },
        {
          "category": "workaround",
          "details": "Currently, no mitigation is available for this vulnerability.",
          "product_ids": [
            "BaseOS-8.2.0.Z.AUS:glib2-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-0:2.56.4-8.el8_2.2.src",
            "BaseOS-8.2.0.Z.AUS:glib2-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-debuginfo-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-debuginfo-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-debugsource-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-debugsource-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-devel-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-devel-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-devel-debuginfo-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-devel-debuginfo-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-fam-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-fam-debuginfo-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-fam-debuginfo-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-tests-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-tests-debuginfo-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-tests-debuginfo-0:2.56.4-8.el8_2.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "BaseOS-8.2.0.Z.AUS:glib2-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-0:2.56.4-8.el8_2.2.src",
            "BaseOS-8.2.0.Z.AUS:glib2-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-debuginfo-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-debuginfo-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-debugsource-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-debugsource-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-devel-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-devel-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-devel-debuginfo-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-devel-debuginfo-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-fam-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-fam-debuginfo-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-fam-debuginfo-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-tests-0:2.56.4-8.el8_2.2.x86_64",
            "BaseOS-8.2.0.Z.AUS:glib2-tests-debuginfo-0:2.56.4-8.el8_2.2.i686",
            "BaseOS-8.2.0.Z.AUS:glib2-tests-debuginfo-0:2.56.4-8.el8_2.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "glib: Buffer Underflow on GLib through glib/gstring.c via function g_string_insert_unichar"
    }
  ]
}

CVE-2024-34397 (GCVE-0-2024-34397)

Vulnerability from cvelistv5 – Published: 2024-05-07 00:00 – Updated: 2026-10-15 00:40

Summary

An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. When a GDBus-based client subscribes to signals from a trusted system service such as NetworkManager on a shared computer, other users of the same computer can send spoofed D-Bus signals that the GDBus-based client will wrongly interpret as having been sent by the trusted system service. This could lead to the GDBus-based client behaving incorrectly, with an application-dependent impact.

Severity

5.2 (Medium)


                        
                          CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-05-09 19:45 UTC

CWE

n/a
CWE-290 - Authentication Bypass by Spoofing

Assigner

mitre CNA under the mitre root

CNA scorecard E 28/100 over 2325 records in the last 180 days details

References

14 references

URL	Tags
https://gitlab.gnome.org/GNOME/glib/-/issues/3268
https://www.openwall.com/lists/oss-security/2024/…
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.debian.org/debian-lts-announce/2024…	mailing-list
https://security.netapp.com/advisory/ntap-2024053…
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

6 products

Vendor	Product	Version
Siemens	RUGGEDCOM RST2428P	Affected: 0 , < V3.1 (custom)
Siemens	SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family	Unaffected: 0 , < * (custom)
Siemens	SCALANCE XCM-/XRM-/XCH-/XRH-300 family	Affected: 0 , < V3.1 (custom)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "PHYSICAL",
              "availabilityImpact": "LOW",
              "baseScore": 5.2,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-34397",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-09T19:45:07.808061Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-290",
                "description": "CWE-290 Authentication Bypass by Spoofing",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-15T17:14:35.675Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T22:06:15.286Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3268"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.openwall.com/lists/oss-security/2024/05/07/5"
          },
          {
            "name": "FEDORA-2024-be032e564d",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IRSFYAE5X23TNRWX7ZWEJOMISLCDSYNS/"
          },
          {
            "name": "FEDORA-2024-2ce1c754f7",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UNFJHISR4O6VFOHBFWH5I5WWMG37H63A/"
          },
          {
            "name": "[debian-lts-announce] 20240513 [SECURITY] [DLA 3814-1] glib2.0 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/05/msg00008.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240531-0008/"
          },
          {
            "name": "FEDORA-2024-fd2569c4e9",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LL6HSJDXCXMLEIJBYV6CPOR4K2NTCTXW/"
          },
          {
            "name": "FEDORA-2024-635a54eb7e",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LCDY3KA7G7D3DRXYTT46K6LFHS2KHWBH/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IRSFYAE5X23TNRWX7ZWEJOMISLCDSYNS/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UNFJHISR4O6VFOHBFWH5I5WWMG37H63A/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LCDY3KA7G7D3DRXYTT46K6LFHS2KHWBH/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LL6HSJDXCXMLEIJBYV6CPOR4K2NTCTXW/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM RST2428P",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XCM-/XRM-/XCH-/XRH-300 family",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T00:40:45.830Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-613116.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. When a GDBus-based client subscribes to signals from a trusted system service such as NetworkManager on a shared computer, other users of the same computer can send spoofed D-Bus signals that the GDBus-based client will wrongly interpret as having been sent by the trusted system service. This could lead to the GDBus-based client behaving incorrectly, with an application-dependent impact."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-10T18:08:40.913Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3268"
        },
        {
          "url": "https://www.openwall.com/lists/oss-security/2024/05/07/5"
        },
        {
          "name": "FEDORA-2024-be032e564d",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IRSFYAE5X23TNRWX7ZWEJOMISLCDSYNS/"
        },
        {
          "name": "FEDORA-2024-2ce1c754f7",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UNFJHISR4O6VFOHBFWH5I5WWMG37H63A/"
        },
        {
          "name": "[debian-lts-announce] 20240513 [SECURITY] [DLA 3814-1] glib2.0 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2024/05/msg00008.html"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240531-0008/"
        },
        {
          "name": "FEDORA-2024-fd2569c4e9",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LL6HSJDXCXMLEIJBYV6CPOR4K2NTCTXW/"
        },
        {
          "name": "FEDORA-2024-635a54eb7e",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LCDY3KA7G7D3DRXYTT46K6LFHS2KHWBH/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2024-34397",
    "datePublished": "2024-05-07T00:00:00.000Z",
    "dateReserved": "2024-05-02T00:00:00.000Z",
    "dateUpdated": "2026-10-15T00:40:45.830Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-52533 (GCVE-0-2024-52533)

Vulnerability from cvelistv5 – Published: 2024-11-11 00:00 – Updated: 2026-10-15 00:58

Summary

gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4_CONN_MSG_LEN is not sufficient for a trailing '\0' character.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-11-12 15:46 UTC

CWE

n/a
CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Assigner

mitre CNA under the mitre root

CNA scorecard E 28/100 over 2325 records in the last 180 days details

References

9 references

URL	Tags
https://gitlab.gnome.org/Teams/Releng/security/-/…
https://gitlab.gnome.org/GNOME/glib/-/issues/3461
https://gitlab.gnome.org/GNOME/glib/-/releases/2.82.1
http://www.openwall.com/lists/oss-security/2024/1…
https://lists.debian.org/debian-lts-announce/2024…
https://security.netapp.com/advisory/ntap-2024120…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

31 products

Vendor	Product	Version
gnome	glib	Affected: 0 , < 2.82.1 (custom) cpe:2.3:a:gnome:glib::::::::
Siemens	RUGGEDCOM RST2428P	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XCH328	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XCM324	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XCM328	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XCM332	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XRH334 (24 V DC, 8xFO, CC)	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XRM334 (230 V AC, 12xFO)	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XRM334 (230 V AC, 8xFO)	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+)	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XRM334 (24 V DC, 12xFO)	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XRM334 (24 V DC, 8xFO)	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+)	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XRM334 (2x230 V AC, 12xFO)	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XRM334 (2x230 V AC, 8xFO)	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+)	Affected: 0 , < V3.3 (custom)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.0 , < V3.1.5 (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.0 , < V3.1.5 (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.0 , < V3.1.5 (custom)
Siemens	RUGGEDCOM ROX MX5000	Affected: 0 , < V2.17.0 (custom)
Siemens	RUGGEDCOM ROX MX5000RE	Affected: 0 , < V2.17.0 (custom)
Siemens	RUGGEDCOM ROX RX1400	Affected: 0 , < V2.17.0 (custom)
Siemens	RUGGEDCOM ROX RX1500	Affected: 0 , < V2.17.0 (custom)
Siemens	RUGGEDCOM ROX RX1501	Affected: 0 , < V2.17.0 (custom)
Siemens	RUGGEDCOM ROX RX1510	Affected: 0 , < V2.17.0 (custom)
Siemens	RUGGEDCOM ROX RX1511	Affected: 0 , < V2.17.0 (custom)
Siemens	RUGGEDCOM ROX RX1512	Affected: 0 , < V2.17.0 (custom)
Siemens	RUGGEDCOM ROX RX1524	Affected: 0 , < V2.17.0 (custom)
Siemens	RUGGEDCOM ROX RX1536	Affected: 0 , < V2.17.0 (custom)
Siemens	RUGGEDCOM ROX RX5000	Affected: 0 , < V2.17.0 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:gnome:glib:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "glib",
            "vendor": "gnome",
            "versions": [
              {
                "lessThan": "2.82.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-52533",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-12T15:46:58.614686Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-120",
                "description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-12T15:49:33.348Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-12-06T13:09:32.561Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2024/11/12/11"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00020.html"
          },
          {
            "url": "https://security.netapp.com/advisory/ntap-20241206-0009/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM RST2428P",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XCH328",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XCM324",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XCM328",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XCM332",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRH334 (24 V DC, 8xFO, CC)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (230 V AC, 12xFO)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (230 V AC, 8xFO)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (24 V DC, 12xFO)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (24 V DC, 8xFO)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (2x230 V AC, 12xFO)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (2x230 V AC, 8xFO)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1.5",
                "status": "affected",
                "version": "V3.1.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1.5",
                "status": "affected",
                "version": "V3.1.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1.5",
                "status": "affected",
                "version": "V3.1.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1.5",
                "status": "affected",
                "version": "V3.1.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1.5",
                "status": "affected",
                "version": "V3.1.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX MX5000",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.17.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX MX5000RE",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.17.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX RX1400",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.17.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX RX1500",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.17.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX RX1501",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.17.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX RX1510",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.17.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX RX1511",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.17.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX RX1512",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.17.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX RX1524",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.17.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX RX1536",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.17.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX RX5000",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.17.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T00:58:25.123Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-202008.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-089022.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4_CONN_MSG_LEN is not sufficient for a trailing \u0027\\0\u0027 character."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-11T22:57:28.795Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://gitlab.gnome.org/Teams/Releng/security/-/wikis/home"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3461"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/glib/-/releases/2.82.1"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2024-52533",
    "datePublished": "2024-11-11T00:00:00.000Z",
    "dateReserved": "2024-11-11T00:00:00.000Z",
    "dateUpdated": "2026-10-15T00:58:25.123Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-4373 (GCVE-0-2025-4373)

Vulnerability from cvelistv5 – Published: 2025-05-06 14:48 – Updated: 2026-10-15 01:02

Title

Glib: buffer underflow on glib through glib/gstring.c via function g_string_insert_unichar

Summary

Severity

4.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-05-06 15:09 UTC

CWE

CWE-124 - Buffer Underwrite ('Buffer Underflow')

Assigner

redhat CNA under the redhat root

CNA scorecard B 82/100 over 1037 records in the last 180 days details

References

17 references

URL	Tags
https://access.redhat.com/errata/RHSA-2025:10855	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:11140	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:11327	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:11373	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:11374	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:11662	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:12275	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:13335	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:14988	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:14989	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:14990	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:14991	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2025-4373	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2364265	issue-trackingx_refsource_REDHAT
https://gitlab.gnome.org/GNOME/glib/-/issues/3677
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

48 products

Vendor	Product	Version
		Affected: 0 , < 2.84.2 (semver)
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:2.80.4-4.el10_0.6 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.0
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:2.56.4-166.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::crb cpe:/o:redhat:enterprise_linux:8::baseos
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	Unaffected: 0:2.56.4-8.el8_2.2 , < * (rpm) cpe:/o:redhat:rhel_aus:8.2::baseos
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 0:2.56.4-10.el8_4.2 , < * (rpm) cpe:/o:redhat:rhel_aus:8.4::baseos cpe:/o:redhat:rhel_eus_long_life:8.4::baseos
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	Unaffected: 0:2.56.4-10.el8_4.2 , < * (rpm) cpe:/o:redhat:rhel_aus:8.4::baseos cpe:/o:redhat:rhel_eus_long_life:8.4::baseos
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 0:2.56.4-158.el8_6.2 , < * (rpm) cpe:/o:redhat:rhel_aus:8.6::baseos cpe:/o:redhat:rhel_e4s:8.6::baseos cpe:/o:redhat:rhel_tus:8.6::baseos
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	Unaffected: 0:2.56.4-158.el8_6.2 , < * (rpm) cpe:/o:redhat:rhel_aus:8.6::baseos cpe:/o:redhat:rhel_e4s:8.6::baseos cpe:/o:redhat:rhel_tus:8.6::baseos
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	Unaffected: 0:2.56.4-158.el8_6.2 , < * (rpm) cpe:/o:redhat:rhel_aus:8.6::baseos cpe:/o:redhat:rhel_e4s:8.6::baseos cpe:/o:redhat:rhel_tus:8.6::baseos
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 0:2.56.4-162.el8_8 , < * (rpm) cpe:/o:redhat:rhel_e4s:8.8::baseos cpe:/o:redhat:rhel_tus:8.8::baseos
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 0:2.56.4-162.el8_8 , < * (rpm) cpe:/o:redhat:rhel_e4s:8.8::baseos cpe:/o:redhat:rhel_tus:8.8::baseos
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:2.68.4-16.el9_6.2 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream cpe:/a:redhat:enterprise_linux:9::crb cpe:/o:redhat:enterprise_linux:9::baseos
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	Unaffected: 0:2.68.4-5.el9_0.2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.0::appstream cpe:/o:redhat:rhel_e4s:9.0::baseos
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:2.68.4-7.el9_2.2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2::appstream cpe:/o:redhat:rhel_e4s:9.2::baseos
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 0:2.68.4-14.el9_4.3 , < * (rpm) cpe:/a:redhat:rhel_eus:9.4::appstream cpe:/a:redhat:rhel_eus:9.4::crb cpe:/o:redhat:rhel_eus:9.4::baseos
Red Hat	Red Hat Insights proxy 1.5	Unaffected: 1.5.5-1754504343 , < * (rpm) cpe:/a:redhat:insights_proxy:1.5::el9
Red Hat	Red Hat OpenShift distributed tracing 3.6.0	Unaffected: rhosdt-3.6-1753265330 , < * (rpm) cpe:/a:redhat:openshift_distributed_tracing:3.6::el8
Red Hat	Red Hat OpenShift distributed tracing 3.6.0	Unaffected: rhosdt-3.6-1753265394 , < * (rpm) cpe:/a:redhat:openshift_distributed_tracing:3.6::el8
Red Hat	Red Hat OpenShift distributed tracing 3.6.0	Unaffected: rhosdt-3.6-1753265332 , < * (rpm) cpe:/a:redhat:openshift_distributed_tracing:3.6::el8
Red Hat	Red Hat OpenShift distributed tracing 3.6.0	Unaffected: rhosdt-3.6-1753265435 , < * (rpm) cpe:/a:redhat:openshift_distributed_tracing:3.6::el8
Red Hat	Red Hat OpenShift distributed tracing 3.6.0	Unaffected: rhosdt-3.6-1753265342 , < * (rpm) cpe:/a:redhat:openshift_distributed_tracing:3.6::el8
Red Hat	Red Hat OpenShift distributed tracing 3.6.0	Unaffected: rhosdt-3.6-1753269432 , < * (rpm) cpe:/a:redhat:openshift_distributed_tracing:3.6::el8
Red Hat	Red Hat OpenShift distributed tracing 3.6.0	Unaffected: rhosdt-3.6-1753265411 , < * (rpm) cpe:/a:redhat:openshift_distributed_tracing:3.6::el8
Red Hat	Red Hat OpenShift distributed tracing 3.6.0	Unaffected: rhosdt-3.6-1753265314 , < * (rpm) cpe:/a:redhat:openshift_distributed_tracing:3.6::el8
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Siemens	RUGGEDCOM RST2428P	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XCH328	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XCM324	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XCM328	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XCM332	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XRH334 (24 V DC, 8xFO, CC)	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XRM334 (230 V AC, 12xFO)	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XRM334 (230 V AC, 8xFO)	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+)	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XRM334 (24 V DC, 12xFO)	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XRM334 (24 V DC, 8xFO)	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+)	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XRM334 (2x230 V AC, 12xFO)	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XRM334 (2x230 V AC, 8xFO)	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+)	Affected: 0 , < V3.3 (custom)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)

Date Public

2025-05-06 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-4373",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-06T15:09:21.791020Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-06T15:09:46.724Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM RST2428P",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XCH328",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XCM324",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XCM328",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XCM332",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRH334 (24 V DC, 8xFO, CC)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (230 V AC, 12xFO)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (230 V AC, 8xFO)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (24 V DC, 12xFO)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (24 V DC, 8xFO)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (2x230 V AC, 12xFO)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (2x230 V AC, 8xFO)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T01:02:07.725Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-089022.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://gitlab.gnome.org/GNOME/glib",
          "defaultStatus": "unaffected",
          "packageName": "glib",
          "versions": [
            {
              "lessThan": "2.84.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.0"
          ],
          "defaultStatus": "affected",
          "packageName": "glib2",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.80.4-4.el10_0.6",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::crb",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "glib2",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.56.4-166.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_aus:8.2::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "glib2",
          "product": "Red Hat Enterprise Linux 8.2 Advanced Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.56.4-8.el8_2.2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_aus:8.4::baseos",
            "cpe:/o:redhat:rhel_eus_long_life:8.4::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "glib2",
          "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.56.4-10.el8_4.2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_aus:8.4::baseos",
            "cpe:/o:redhat:rhel_eus_long_life:8.4::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "glib2",
          "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.56.4-10.el8_4.2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_aus:8.6::baseos",
            "cpe:/o:redhat:rhel_e4s:8.6::baseos",
            "cpe:/o:redhat:rhel_tus:8.6::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "glib2",
          "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.56.4-158.el8_6.2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_aus:8.6::baseos",
            "cpe:/o:redhat:rhel_e4s:8.6::baseos",
            "cpe:/o:redhat:rhel_tus:8.6::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "glib2",
          "product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.56.4-158.el8_6.2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_aus:8.6::baseos",
            "cpe:/o:redhat:rhel_e4s:8.6::baseos",
            "cpe:/o:redhat:rhel_tus:8.6::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "glib2",
          "product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.56.4-158.el8_6.2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_e4s:8.8::baseos",
            "cpe:/o:redhat:rhel_tus:8.8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "glib2",
          "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.56.4-162.el8_8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_e4s:8.8::baseos",
            "cpe:/o:redhat:rhel_tus:8.8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "glib2",
          "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.56.4-162.el8_8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/a:redhat:enterprise_linux:9::crb",
            "cpe:/o:redhat:enterprise_linux:9::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "glib2",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.68.4-16.el9_6.2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/a:redhat:enterprise_linux:9::crb",
            "cpe:/o:redhat:enterprise_linux:9::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "glib2",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.68.4-16.el9_6.2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:9.0::appstream",
            "cpe:/o:redhat:rhel_e4s:9.0::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "glib2",
          "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.68.4-5.el9_0.2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:9.2::appstream",
            "cpe:/o:redhat:rhel_e4s:9.2::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "glib2",
          "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.68.4-7.el9_2.2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.4::appstream",
            "cpe:/a:redhat:rhel_eus:9.4::crb",
            "cpe:/o:redhat:rhel_eus:9.4::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "glib2",
          "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:2.68.4-14.el9_4.3",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:insights_proxy:1.5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "insights-proxy/insights-proxy-container-rhel9",
          "product": "Red Hat Insights proxy 1.5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1.5.5-1754504343",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift_distributed_tracing:3.6::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhosdt/jaeger-agent-rhel8",
          "product": "Red Hat OpenShift distributed tracing 3.6.0",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "rhosdt-3.6-1753265330",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift_distributed_tracing:3.6::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhosdt/jaeger-all-in-one-rhel8",
          "product": "Red Hat OpenShift distributed tracing 3.6.0",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "rhosdt-3.6-1753265394",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift_distributed_tracing:3.6::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhosdt/jaeger-collector-rhel8",
          "product": "Red Hat OpenShift distributed tracing 3.6.0",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "rhosdt-3.6-1753265332",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift_distributed_tracing:3.6::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhosdt/jaeger-es-index-cleaner-rhel8",
          "product": "Red Hat OpenShift distributed tracing 3.6.0",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "rhosdt-3.6-1753265435",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift_distributed_tracing:3.6::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhosdt/jaeger-es-rollover-rhel8",
          "product": "Red Hat OpenShift distributed tracing 3.6.0",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "rhosdt-3.6-1753265342",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift_distributed_tracing:3.6::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhosdt/jaeger-ingester-rhel8",
          "product": "Red Hat OpenShift distributed tracing 3.6.0",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "rhosdt-3.6-1753265332",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift_distributed_tracing:3.6::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhosdt/jaeger-operator-bundle",
          "product": "Red Hat OpenShift distributed tracing 3.6.0",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "rhosdt-3.6-1753269432",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift_distributed_tracing:3.6::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhosdt/jaeger-query-rhel8",
          "product": "Red Hat OpenShift distributed tracing 3.6.0",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "rhosdt-3.6-1753265411",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift_distributed_tracing:3.6::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhosdt/jaeger-rhel8-operator",
          "product": "Red Hat OpenShift distributed tracing 3.6.0",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "rhosdt-3.6-1753265314",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "bootc",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "glycin-loaders",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "loupe",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "mingw-glib2",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "affected",
          "packageName": "glib2",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "affected",
          "packageName": "glib2",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "librsvg2",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "mingw-glib2",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "bootc",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "librsvg2",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "mingw-glib2",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2025-05-06T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in GLib, which is vulnerable to an integer overflow in the g_string_insert_unichar() function. When the position at which to insert the character is large, the position will overflow, leading to a buffer underwrite."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-124",
              "description": "Buffer Underwrite (\u0027Buffer Underflow\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T17:08:27.078Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2025:10855",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:10855"
        },
        {
          "name": "RHSA-2025:11140",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:11140"
        },
        {
          "name": "RHSA-2025:11327",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:11327"
        },
        {
          "name": "RHSA-2025:11373",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:11373"
        },
        {
          "name": "RHSA-2025:11374",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:11374"
        },
        {
          "name": "RHSA-2025:11662",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:11662"
        },
        {
          "name": "RHSA-2025:12275",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:12275"
        },
        {
          "name": "RHSA-2025:13335",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:13335"
        },
        {
          "name": "RHSA-2025:14988",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:14988"
        },
        {
          "name": "RHSA-2025:14989",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:14989"
        },
        {
          "name": "RHSA-2025:14990",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:14990"
        },
        {
          "name": "RHSA-2025:14991",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:14991"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2025-4373"
        },
        {
          "name": "RHBZ#2364265",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2364265"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3677"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-05-06T00:33:30.003Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2025-05-06T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Glib: buffer underflow on glib through glib/gstring.c via function g_string_insert_unichar",
      "workarounds": [
        {
          "lang": "en",
          "value": "Currently, no mitigation is available for this vulnerability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-124: Buffer Underwrite (\u0027Buffer Underflow\u0027)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2025-4373",
    "datePublished": "2025-05-06T14:48:39.264Z",
    "dateReserved": "2025-05-06T00:35:29.069Z",
    "dateUpdated": "2026-10-15T01:02:07.725Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2025:14991

CVE-2024-34397 (GCVE-0-2024-34397)

CVE-2024-52533 (GCVE-0-2024-52533)

CVE-2025-4373 (GCVE-0-2025-4373)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour