A vulnerability has been discovered in GLib, which can lead to privilege escalation.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/glib | * | < 2.78.6 | >= 2.78.6 |
GLib is a library providing a number of GNOME's core objects and functions.
A vulnerability has been discovered in GLib. Please review the CVE identifier referenced below for details.
When a GDBus-based client subscribes to signals from a trusted system service such as NetworkManager or logind on a shared computer, other users of the same computer can send spoofed D-Bus signals that the GDBus-based client will wrongly interpret as having been sent by the trusted system service. This could lead to the GDBus-based client behaving incorrectly, with an application-dependent impact.
There is no known workaround at this time.
All GLib users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/glib-2.78.6"
Multiple vulnerabilities have been discovered in GLib.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/glib | * | < 2.74.4 | >= 2.74.4 |
GLib is a library providing a number of GNOME's core objects and functions.
Multiple vulnerabilities have been discovered in GLib. Please review the referenced CVEs for details.
GVariant deserialization is vulnerable to an exponential blowup issue where a crafted GVariant can cause excessive processing, leading to denial of service. GVariant deserialization fails to validate that the input conforms to the expected format, leading to denial of service. GVariant deserialization is vulnerable to a slowdown issue where a crafted GVariant can cause excessive processing, leading to denial of service.
There is no known workaround at this time.
All GLib users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/glib-2.74.4"
Multiple vulnerabilities have been found in GLib, the worst of which could result in the arbitrary execution of code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/glib | * | < 2.66.8 | >= 2.66.8 |
GLib is a library providing a number of GNOME’s core objects and functions.
Multiple vulnerabilities have been discovered in GLib. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All GLib users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/glib-2.66.8"
Multiple vulnerabilities have been found in GLib, the worst of which could result in a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/glib | * | < 2.56.4 | >= 2.56.4 |
GLib is a library providing a number of GNOME’s core objects and functions.
Multiple vulnerabilities have been discovered in GLib. Please review the referenced bug for details.
Please review the referenced bugs for details.
There is no known workaround at this time.
All GLib users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/glib-2.56.4"
A vulnerability has been found in D-Bus which allows local attackers to gain escalated privileges.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/glib | * | < 2.32.4-r1 | >= 2.32.4-r1 |
| sys-apps/dbus | * | < 1.6.8 | >= 1.6.8 |
D-Bus is a daemon providing a framework for applications to communicate with one another. GLib is a library providing a number of GNOME’s core objects and functions.
When libdbus is used in a setuid program, a user can gain escalated privileges by leveraging the DBUS_SYSTEM_BUS_ADDRESS variable. GLib can be used in a setuid context with D-Bus, and so can trigger this vulnerability. Please review the CVE identifier below for more details.
A local attacker could gain escalated privileges and execute arbitrary code.
There is no known workaround at this time.
All D-Bus users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/dbus-1.6.8"
All GLib users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/glib-2.32.4-r1"
Multiple integer overflows might allow for the execution of arbitrary code when performing base64 conversion.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/glib | * | < 2.18.4-r1 | >= 2.18.4-r1, >= 2.16.6-r1 (revision), < 2 |
The GLib is a library of C routines that is used by a multitude of programs.
Diego E. Petteno` reported multiple integer overflows in glib/gbase64.c when converting a long string from or to a base64 representation.
A remote attacker could entice a user or automated system to perform a base64 conversion via an application using GLib, possibly resulting in the execution of arbitrary code.
There is no known workaround at this time.
All GLib 2.18 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/glib-2.18.4-r1"
All GLib 2.16 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/glib-2.16.6-r1"
A buffer overflow vulnerability has been discovered in PCRE, allowing for the execution of arbitrary code and a Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/glib | * | < 2.16.3-r1 | >= 2.16.3-r1, < 2.14.0 |
| dev-libs/libpcre | * | < 7.7-r1 | >= 7.7-r1 |
PCRE is a Perl-compatible regular expression library. GLib includes a copy of PCRE.
Tavis Ormandy of the Google Security team reported a heap-based buffer overflow when compiling regular expression patterns containing "Internal Option Settings" such as "(?i)".
A remote attacker could exploit this vulnerability by sending a specially crafted regular expression to an application making use of the PCRE library, which could possibly lead to the execution of arbitrary code or a Denial of Service.
There is no known workaround at this time.
All PCRE users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/libpcre-7.7-r1"
All GLib users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/glib-2.16.3-r1"
A buffer overflow vulnerability has been discovered in PCRE, allowing for the execution of arbitrary code and Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/glib | * | < 2.14.6 | >= 2.14.6, < 2.14.0 |
| dev-libs/libpcre | * | < 7.6-r1 | >= 7.6-r1 |
PCRE is a Perl-compatible regular expression library. GLib includes a copy of PCRE.
PCRE contains a buffer overflow vulnerability when processing a character class containing a very large number of characters with codepoints greater than 255.
A remote attacker could exploit this vulnerability by sending a specially crafted regular expression to an application making use of the PCRE library, which could possibly lead to the execution of arbitrary code or a Denial of Service.
There is no known workaround at this time.
All PCRE users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/libpcre-7.6-r1"
All GLib users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/glib-2.14.6"