Input validation error in Gnome GLib - CVE-2023-25180

Vulnerability identifier: #VU75362

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-25180

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input when handling a serialised variant. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Gnome GLib
Amazon Linux AMI
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Software Development Kit 12
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
openSUSE Leap Micro
SUSE Linux Enterprise Workstation Extension 12
Basesystem Module
openSUSE Leap
openEuler
Ubuntu
VMware Tanzu Application Service for VMs
Isolation Segment
ObjectScale
Platform Automation Toolkit
glib2
libgio-fam-debuginfo
glib2-debugsource
libglib-2_0-0-32bit
libgthread-2_0-0-32bit
libgio-2_0-0-debuginfo-32bit
libgthread-2_0-0-debuginfo-32bit
libgobject-2_0-0-32bit
libgio-2_0-0-32bit
libgobject-2_0-0-debuginfo-32bit
libgmodule-2_0-0-32bit
libgmodule-2_0-0-debuginfo-32bit
libglib-2_0-0-debuginfo-32bit
glib2-lang
glib2-tools-debuginfo
libgobject-2_0-0
glib2-devel-debuginfo
libgio-2_0-0-debuginfo
glib2-devel-static
libgio-fam
glib2-devel
libgthread-2_0-0
glib2-tools
libgmodule-2_0-0-debuginfo
libglib-2_0-0-debuginfo
libglib-2_0-0
libgobject-2_0-0-debuginfo
libgthread-2_0-0-debuginfo
libgio-2_0-0
libgmodule-2_0-0
libgobject-2_0-0-32bit-debuginfo
libgmodule-2_0-0-32bit-debuginfo
libgio-fam-32bit
libgio-2_0-0-32bit-debuginfo
glib2-tests-debuginfo
glib2-tests
libgio-fam-32bit-debuginfo
libglib-2_0-0-32bit-debuginfo
libglib2.0-0 (Ubuntu package)
libglib2.0-bin (Ubuntu package)
glib2-debuginfo
glib2-help
glib2-tools-32bit-debuginfo
glib2-tests-devel-debuginfo
gio-branding-upstream
glib2-devel-32bit-debuginfo
glib2-tools-32bit
glib2-tests-devel
glib2-devel-32bit
libgthread-2_0-0-32bit-debuginfo
VMware Tanzu Operations Manager
Dell EMC VxRail Appliance
IBM CICS TX Advanced
Dell EMC NetWorker vProxy

Install updates from vendor's website.

Gnome GLib - addressed in versions 2.74.4, 2.75.1
ObjectScale - update to 1.4.0
glib2 - addressed in versions 2.36.3-5.23, 2.74.7-688
libgio-fam-debuginfo - addressed in versions 2.48.2-12.31.1, 2.62.6-150200.3.15.1
glib2-debugsource - addressed in versions 2.48.2-12.31.1, 2.62.6-150200.3.15.1, 2.70.5-150400.3.8.1
libglib-2_0-0-32bit - addressed in versions 2.48.2-12.31.1, 2.62.6-150200.3.15.1, 2.70.5-150400.3.8.1
libgthread-2_0-0-32bit - addressed in versions 2.48.2-12.31.1, 2.70.5-150400.3.8.1
libgio-2_0-0-debuginfo-32bit - update to 2.48.2-12.31.1
libgthread-2_0-0-debuginfo-32bit - update to 2.48.2-12.31.1
libgobject-2_0-0-32bit - addressed in versions 2.48.2-12.31.1, 2.62.6-150200.3.15.1, 2.70.5-150400.3.8.1
libgio-2_0-0-32bit - addressed in versions 2.48.2-12.31.1, 2.62.6-150200.3.15.1, 2.70.5-150400.3.8.1
libgobject-2_0-0-debuginfo-32bit - update to 2.48.2-12.31.1
libgmodule-2_0-0-32bit - addressed in versions 2.48.2-12.31.1, 2.62.6-150200.3.15.1, 2.70.5-150400.3.8.1
libgmodule-2_0-0-debuginfo-32bit - update to 2.48.2-12.31.1
libglib-2_0-0-debuginfo-32bit - update to 2.48.2-12.31.1
glib2-lang - addressed in versions 2.48.2-12.31.1, 2.62.6-150200.3.15.1, 2.70.5-150400.3.8.1
glib2-tools-debuginfo - addressed in versions 2.48.2-12.31.1, 2.62.6-150200.3.15.1, 2.70.5-150400.3.8.1
libgobject-2_0-0 - addressed in versions 2.48.2-12.31.1, 2.62.6-150200.3.15.1, 2.70.5-150400.3.8.1
glib2-devel-debuginfo - addressed in versions 2.48.2-12.31.1, 2.62.6-150200.3.15.1, 2.70.5-150400.3.8.1
libgio-2_0-0-debuginfo - addressed in versions 2.48.2-12.31.1, 2.62.6-150200.3.15.1, 2.70.5-150400.3.8.1
glib2-devel-static - addressed in versions 2.48.2-12.31.1, 2.70.5-150400.3.8.1
libgio-fam - addressed in versions 2.48.2-12.31.1, 2.62.6-150200.3.15.1
glib2-devel - addressed in versions 2.48.2-12.31.1, 2.62.6-150200.3.15.1, 2.70.5-150400.3.8.1
libgthread-2_0-0 - addressed in versions 2.48.2-12.31.1, 2.62.6-150200.3.15.1, 2.70.5-150400.3.8.1
glib2-tools - addressed in versions 2.48.2-12.31.1, 2.62.6-150200.3.15.1, 2.70.5-150400.3.8.1
libgmodule-2_0-0-debuginfo - addressed in versions 2.48.2-12.31.1, 2.62.6-150200.3.15.1, 2.70.5-150400.3.8.1
libglib-2_0-0-debuginfo - addressed in versions 2.48.2-12.31.1, 2.62.6-150200.3.15.1, 2.70.5-150400.3.8.1
libglib-2_0-0 - addressed in versions 2.48.2-12.31.1, 2.62.6-150200.3.15.1, 2.70.5-150400.3.8.1
libgobject-2_0-0-debuginfo - addressed in versions 2.48.2-12.31.1, 2.62.6-150200.3.15.1, 2.70.5-150400.3.8.1
libgthread-2_0-0-debuginfo - addressed in versions 2.48.2-12.31.1, 2.62.6-150200.3.15.1, 2.70.5-150400.3.8.1
libgio-2_0-0 - addressed in versions 2.48.2-12.31.1, 2.62.6-150200.3.15.1, 2.70.5-150400.3.8.1
libgmodule-2_0-0 - addressed in versions 2.48.2-12.31.1, 2.62.6-150200.3.15.1, 2.70.5-150400.3.8.1
libgobject-2_0-0-32bit-debuginfo - addressed in versions 2.62.6-150200.3.15.1, 2.70.5-150400.3.8.1
libgmodule-2_0-0-32bit-debuginfo - addressed in versions 2.62.6-150200.3.15.1, 2.70.5-150400.3.8.1
libgio-fam-32bit - update to 2.62.6-150200.3.15.1
libgio-2_0-0-32bit-debuginfo - addressed in versions 2.62.6-150200.3.15.1, 2.70.5-150400.3.8.1
glib2-tests-debuginfo - update to 2.62.6-150200.3.15.1
glib2-tests - update to 2.62.6-150200.3.15.1
libgio-fam-32bit-debuginfo - update to 2.62.6-150200.3.15.1
libglib-2_0-0-32bit-debuginfo - addressed in versions 2.62.6-150200.3.15.1, 2.70.5-150400.3.8.1
libglib2.0-0 (Ubuntu package) - addressed in versions 2.64.6-1~ubuntu20.04.6, 2.72.4-0ubuntu2.2, 2.74.3-0ubuntu1.2
libglib2.0-bin (Ubuntu package) - addressed in versions 2.64.6-1~ubuntu20.04.6, 2.72.4-0ubuntu2.2, 2.74.3-0ubuntu1.2
glib2 - update to 2.66.8-11
glib2-devel - update to 2.66.8-11
glib2-debuginfo - update to 2.66.8-11
glib2-debugsource - update to 2.66.8-11
glib2-help - update to 2.66.8-11
glib2-tools-32bit-debuginfo - update to 2.70.5-150400.3.8.1
glib2-tests-devel-debuginfo - update to 2.70.5-150400.3.8.1
gio-branding-upstream - update to 2.70.5-150400.3.8.1
glib2-devel-32bit-debuginfo - update to 2.70.5-150400.3.8.1
glib2-tools-32bit - update to 2.70.5-150400.3.8.1
glib2-tests-devel - update to 2.70.5-150400.3.8.1
glib2-devel-32bit - update to 2.70.5-150400.3.8.1
libgthread-2_0-0-32bit-debuginfo - update to 2.70.5-150400.3.8.1
VMware Tanzu Operations Manager - update to 3.0.12
Platform Automation Toolkit - addressed in versions 4.4.19, 5.0.0, 5.1.0
Dell EMC VxRail Appliance - update to 8.0.101
IBM CICS TX Advanced - update to 10.1.0.0 ifix21
Dell EMC NetWorker vProxy - addressed in versions 19.8.0.3, 19.9.0.2

• https://discourse.gnome.org/t/multiple-fixes-for-gvariant-normalisation-issues-in-glib/12835
• https://gitlab.gnome.org/GNOME/glib/-/merge_requests/3126
• https://bugzilla.redhat.com/show_bug.cgi?id=2181182

• Multiple vulnerabilities in Gnome GLib
• SUSE update for glib2
• SUSE update for glib2
• SUSE update for glib2
• Amazon Linux AMI update for glib2
• Ubuntu update for glib2.0
• Multiple vulnerabilities in Dell EMC VxRail Appliance
• VMware Tanzu products update for GLib
• Multiple vulnerabilities in IBM CICS TX Advanced
• Multiple vulnerabilities in Dell NetWorker vProxy
• openEuler update for glib2
• Multiple vulnerabilities in Dell ObjectScale
• Amazon Linux AMI update for glib2