CVE-2025-6052

A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn’t. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corruption.

References

Affected packages

Debian:13 / glib2.0

Package

Name: glib2.0
Purl: pkg:deb/debian/glib2.0?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.84.3-1

Affected versions

2.*

2.74.6-2

2.75.0-1

2.75.2-1

2.75.3-1

2.75.3-2

2.75.3-3

2.75.4-1

2.76.0-1

2.76.1-1

2.76.2-1

2.76.3-1

2.76.4-1

2.76.4-2

2.76.4-3

2.76.4-4

2.77.0-1

2.77.1-1

2.77.1-2

2.77.2-1

2.77.3-1

2.78.0-1

2.78.0-2

2.78.1-1

2.78.1-2

2.78.1-3

2.78.1-4

2.78.2-1

2.78.3-1

2.78.3-2

2.78.4-1

2.78.4-2

2.78.4-2.1

2.78.4-3

2.78.4-4

2.78.4-5

2.78.4-6

2.78.4-7

2.79.0+git20240110~g38f5ba3c-1

2.79.0+git20240110~g38f5ba3c-2

2.79.0+git20240119~62ee8bf6-1

2.79.1-1

2.79.1-1.1~exp1

2.79.2-1

2.79.3-1

2.79.3-2

2.79.3-3

2.80.0-1

2.80.0-2

2.80.0-3

2.80.0-4

2.80.0-5

2.80.0-6

2.80.0-7

2.80.0-8

2.80.0-9

2.80.0-10

2.80.1-1

2.80.2-1

2.80.2-2

2.80.3-1

2.80.4-1

2.81.0-1

2.81.1-1

2.81.1-2

2.81.1-3

2.81.2-1

2.82.0-1

2.82.0-2

2.82.1-1

2.82.2-1

2.82.2-2

2.82.2-3

2.82.3-1

2.82.3-2

2.82.4-1

2.82.4-2

2.83.2-1

2.83.2-2

2.83.3-1

2.83.3-2

2.83.4-1

2.83.5-1

2.84.0-1

2.84.0-2

2.84.1-1

2.84.1-2

2.84.1-3

2.84.2-1

Ecosystem specific

{
    "urgency": "unimportant"
}