Gnome Glib vulnerabilities

CVE-2023-29499 [HIGH] CWE-400 CVE-2023-29499: A flaw was found in GLib. GVariant deserialization fails to validate that the input conforms to the A flaw was found in GLib. GVariant deserialization fails to validate that the input conforms to the expected format, leading to denial of service.

CVE-2025-4056 [HIGH] CWE-94 CVE-2025-4056: A flaw was found in GLib. A denial of service on Windows platforms may occur if an application attem A flaw was found in GLib. A denial of service on Windows platforms may occur if an application attempts to spawn a program using long command lines.

CVE-2018-16429 [HIGH] CWE-125 CVE-2018-16429: GNOME GLib 2.56.1 has an out-of-bounds read vulnerability in g_markup_parse_context_parse() in gmark GNOME GLib 2.56.1 has an out-of-bounds read vulnerability in g_markup_parse_context_parse() in gmarkup.c, related to utf8_str().

CVE-2025-14512 [MEDIUM] CWE-190 CVE-2025-14512: A flaw was found in glib. This vulnerability allows a heap buffer overflow and denial-of-service (Do A flaw was found in glib. This vulnerability allows a heap buffer overflow and denial-of-service (DoS) via an integer overflow in GLib's GIO (GLib Input/Output) escape_byte_string() function when processing malicious file or remote filesystem attribute values.

CVE-2020-6750 [MEDIUM] CVE-2020-6750: GSocketClient in GNOME GLib through 2.62.4 may occasionally connect directly to a target address ins GSocketClient in GNOME GLib through 2.62.4 may occasionally connect directly to a target address instead of connecting via a proxy server when configured to do so, because the proxy_addr field is mishandled. This bug is timing-dependent and may occur only sporadically depending on network delays. The greatest security relevance is in use cases where a proxy i

CVE-2009-3289 [HIGH] CWE-732 CVE-2009-3289: The g_file_copy function in glib 2.0 sets the permissions of a target file to the permissions of a s The g_file_copy function in glib 2.0 sets the permissions of a target file to the permissions of a symbolic link (777), which allows user-assisted local users to modify files of other users, as demonstrated by using Nautilus to modify the permissions of the user home directory.

CVE-2021-28153 [MEDIUM] CWE-59 CVE-2021-28153: An issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is used with G_FILE_CREAT An issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a dangling symlink, it incorrectly also creates the target of the symlink as an empty file, which could conceivably have security relevance if the symlink is attacker-controlled. (If the path is a symlink

CVE-2019-9633 [MEDIUM] CWE-754 CVE-2019-9633: gio/gsocketclient.c in GNOME GLib 2.59.2 does not ensure that a parent GTask remains alive during th gio/gsocketclient.c in GNOME GLib 2.59.2 does not ensure that a parent GTask remains alive during the execution of a connection-attempting enumeration, which allows remote attackers to cause a denial of service (g_socket_client_connected_callback mishandling and application crash) via a crafted web site, as demonstrated by GNOME Web (aka Epiphany).

CVE-2024-34397 [MEDIUM] CWE-290 CVE-2024-34397: An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. When a GDB An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. When a GDBus-based client subscribes to signals from a trusted system service such as NetworkManager on a shared computer, other users of the same computer can send spoofed D-Bus signals that the GDBus-based client will wrongly interpret as having been sent by

CVE-2021-3800 [MEDIUM] CWE-200 CVE-2021-3800: A flaw was found in glib before version 2.63.6. Due to random charset alias, pkexec can leak content A flaw was found in glib before version 2.63.6. Due to random charset alias, pkexec can leak content from files owned by privileged users to unprivileged ones under the right condition.

CVE-2008-4316 [MEDIUM] CWE-189 CVE-2008-4316: Multiple integer overflows in glib/gbase64.c in GLib before 2.20 allow context-dependent attackers t Multiple integer overflows in glib/gbase64.c in GLib before 2.20 allow context-dependent attackers to execute arbitrary code via a long string that is converted either (1) from or (2) to a base64 representation.

CVE-2023-32665 [MEDIUM] CWE-400 CVE-2023-32665: A flaw was found in GLib. GVariant deserialization is vulnerable to an exponential blowup issue wher A flaw was found in GLib. GVariant deserialization is vulnerable to an exponential blowup issue where a crafted GVariant can cause excessive processing, leading to denial of service.

CVE-2023-32611 [MEDIUM] CWE-400 CVE-2023-32611: A flaw was found in GLib. GVariant deserialization is vulnerable to a slowdown issue where a crafted A flaw was found in GLib. GVariant deserialization is vulnerable to a slowdown issue where a crafted GVariant can cause excessive processing, leading to denial of service.