Integer overflow in Gnome GLib - CVE-2025-3360

Vulnerability identifier: #VU107990

CSH Severity: Medium

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green

CVE-ID: CVE-2025-3360

CWE-ID: CWE-190

Exploitation vector: Remote access

Exploit availability: No public exploit available

Affected software:
Gnome GLib
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Micro for Rancher
SUSE Linux Enterprise Micro
Ubuntu
Basesystem Module
openSUSE Leap
openEuler
SmartFabric Manager
APEX Cloud Platform for Microsoft Azure
Cloud Pak for Data System - Cyclops
glib2.0 (Ubuntu package)
libglib-2_0-0
libgthread-2_0-0-32bit
libgmodule-2_0-0
libgmodule-2_0-0-debuginfo
glib2-tests-devel
glib2-devel-static
glib2-tests-devel-debuginfo
libgthread-2_0-0-debuginfo
libgio-2_0-0-debuginfo
libgio-2_0-0-32bit-debuginfo
libgio-2_0-0-32bit
libglib-2_0-0-32bit-debuginfo
glib2-tools
libgio-2_0-0
glib2-doc
glib2-devel
libgobject-2_0-0
libgthread-2_0-0
glib2-tools-debuginfo
glib2-lang
gio-branding-upstream
glib2-debugsource
glib2-devel-debuginfo
libglib-2_0-0-debuginfo
libgobject-2_0-0-debuginfo
libgobject-2_0-0-32bit
libgthread-2_0-0-64bit
libglib-2_0-0-64bit-debuginfo
glib2-tools-64bit
glib2-devel-64bit-debuginfo
libgobject-2_0-0-64bit-debuginfo
glib2-tools-64bit-debuginfo
glib2-devel-64bit
libgobject-2_0-0-64bit
libgmodule-2_0-0-64bit
libgthread-2_0-0-64bit-debuginfo
libglib-2_0-0-64bit
libgio-2_0-0-64bit
libgmodule-2_0-0-64bit-debuginfo
libgmodule-2_0-0-32bit
libgthread-2_0-0-32bit-debuginfo
libgmodule-2_0-0-32bit-debuginfo
glib2-tools-32bit
libglib-2_0-0-32bit
glib2-devel-32bit-debuginfo
glib2-tools-32bit-debuginfo
libgio-2_0-0-64bit-debuginfo
libgobject-2_0-0-32bit-debuginfo
glib2-devel-32bit
glib2-static
glib2-help
glib2-tests
glib2-debuginfo
glib2
Splunk Operator for Kubernetes Add-on
APEX Cloud Platform for Red Hat OpenShift

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to integer overflow with the g_date_time_new_from_iso8601() function when parsing a long invalid ISO 8601 timestamp. A remote attacker can pass specially crafted data to the application, trigger an integer overflow and perform a denial of service (DoS) attack.

Install updates from vendor's website.

• https://access.redhat.com/security/cve/CVE-2025-3360
• https://bugzilla.redhat.com/show_bug.cgi?id=2357754
• https://lists.debian.org/debian-lts-announce/2025/04/msg00024.html