Input validation error in Gnome GLib - CVE-2023-32636

Vulnerability identifier: #VU77348

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-32636

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can pass specially crafted GVariants to the application and perform a denial of service (DoS) attack.

Gnome GLib
Isolation Segment
VMware Tanzu Application Service for VMs
Netcool Operations Insight
Splunk Operator for Kubernetes Add-on
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE CaaS Platform
SUSE Enterprise Storage
Oracle Solaris
Ubuntu
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
Fedora
watsonx Code Assistant for Ansible
Platform Automation Toolkit
DataStage on Cloud Pak for Data
Cloud Pak for Data System - Cyclops
LANTIME Operating System Firmware (LTOS)
libglib2.0-bin (Ubuntu package)
libglib2.0-0 (Ubuntu package)
glib2-tools
libgmodule-2_0-0-32bit-debuginfo
glib2-devel
libgmodule-2_0-0-debuginfo
libgobject-2_0-0
libgobject-2_0-0-debuginfo
libgthread-2_0-0-debuginfo
glib2-debugsource
libglib-2_0-0-debuginfo
libgio-2_0-0-debuginfo
glib2-tools-debuginfo
glib2-lang
libglib-2_0-0-32bit
glib2-devel-debuginfo
libgmodule-2_0-0
libgio-2_0-0
libglib-2_0-0
libgthread-2_0-0
libgobject-2_0-0-32bit
libgio-2_0-0-32bit-debuginfo
libgmodule-2_0-0-32bit
libgio-2_0-0-32bit
libglib-2_0-0-32bit-debuginfo
libgobject-2_0-0-32bit-debuginfo
mingw-glib2
mingw-glib2 (Red Hat package)
VMware Tanzu Operations Manager
IBM CICS TX Advanced

Install updates from vendor's website.

Gnome GLib - addressed in versions 2.74.4, 2.75.1
Isolation Segment - addressed in versions 3.0.20, 4.0.12
VMware Tanzu Application Service for VMs - addressed in versions 3.0.20, 4.0.12
watsonx Code Assistant for Ansible - update to 5.1.1
LANTIME Operating System Firmware (LTOS) - update to 7.08.007
libglib2.0-bin (Ubuntu package) - addressed in versions Ubuntu Pro, 2.64.6-1~ubuntu20.04.6, 2.72.4-0ubuntu2.2, 2.74.3-0ubuntu1.2
libglib2.0-0 (Ubuntu package) - addressed in versions Ubuntu Pro, 2.64.6-1~ubuntu20.04.6, 2.72.4-0ubuntu2.2, 2.74.3-0ubuntu1.2
Netcool Operations Insight - update to 1.6.12
VMware Tanzu Operations Manager - addressed in versions 2.10.65, 3.0.12
glib2-tools - update to 2.54.3-150000.4.29.1
libgmodule-2_0-0-32bit-debuginfo - update to 2.54.3-150000.4.29.1
glib2-devel - update to 2.54.3-150000.4.29.1
libgmodule-2_0-0-debuginfo - update to 2.54.3-150000.4.29.1
libgobject-2_0-0 - update to 2.54.3-150000.4.29.1
libgobject-2_0-0-debuginfo - update to 2.54.3-150000.4.29.1
libgthread-2_0-0-debuginfo - update to 2.54.3-150000.4.29.1
glib2-debugsource - update to 2.54.3-150000.4.29.1
libglib-2_0-0-debuginfo - update to 2.54.3-150000.4.29.1
libgio-2_0-0-debuginfo - update to 2.54.3-150000.4.29.1
glib2-tools-debuginfo - update to 2.54.3-150000.4.29.1
glib2-lang - update to 2.54.3-150000.4.29.1
libglib-2_0-0-32bit - update to 2.54.3-150000.4.29.1
glib2-devel-debuginfo - update to 2.54.3-150000.4.29.1
libgmodule-2_0-0 - update to 2.54.3-150000.4.29.1
libgio-2_0-0 - update to 2.54.3-150000.4.29.1
libglib-2_0-0 - update to 2.54.3-150000.4.29.1
libgthread-2_0-0 - update to 2.54.3-150000.4.29.1
libgobject-2_0-0-32bit - update to 2.54.3-150000.4.29.1
libgio-2_0-0-32bit-debuginfo - update to 2.54.3-150000.4.29.1
libgmodule-2_0-0-32bit - update to 2.54.3-150000.4.29.1
libgio-2_0-0-32bit - update to 2.54.3-150000.4.29.1
libglib-2_0-0-32bit-debuginfo - update to 2.54.3-150000.4.29.1
libgobject-2_0-0-32bit-debuginfo - update to 2.54.3-150000.4.29.1
mingw-glib2 - addressed in versions 2.74.7-1.fc37, 2.74.7-1.fc38
mingw-glib2 (Red Hat package) - update to 2.78.0-1.el9
Splunk Operator for Kubernetes Add-on - update to 3.0.0
Platform Automation Toolkit - addressed in versions 4.4.19, 4.4.32, 5.0.0, 5.0.25, 5.1.0, 5.1.2
DataStage on Cloud Pak for Data - update to 5.0.0
IBM CICS TX Advanced - update to 10.1.0.0 ifix21
Cloud Pak for Data System - Cyclops - update to 11.3.1.1

• https://bugzilla.redhat.com/show_bug.cgi?id=2211833
• https://gitlab.gnome.org/GNOME/glib/-/issues/2841

• Multiple vulnerabilities in Gnome GLib
• Ubuntu update for glib2.0
• VMware Tanzu products update for GLib
• Fedora 37 update for mingw-glib2
• Fedora 38 update for mingw-glib2
• Multiple vulnerabilities in Oracle Solaris third-party software
• Multiple vulnerabilities in IBM CICS TX Advanced
• SUSE update for glib2
• Ubuntu update for glib2.0
• VMware Tanzu products update for GLib
• Multiple vulnerabilities in Netcool Operations Insight
• Red Hat Enterprise Linux 9 update for mingw-glib2
• IBM DataStage on Cloud Pak for Data update for GNOME GLib
• IBM watsonx Code Assistant On Prem update for GNOME GLib
• Meinberg LANTIME firmware update for third-party components (January 2024)
• Splunk Operator for Kubernetes Add-on update for third-party components
• Multiple vulnerabilities in IBM Cloud Pak for Data System - Cyclops